+ 
- 
+
-
-
+
-
-
- 1. + + 1. Run Monkey Island Server {this.state.completedSteps.run_server ? - + : ''} -
-
- 2. + + 2. Run Monkey {this.state.completedSteps.run_monkey ? - + : ''} -
-
- 3. + + 3. Infection Map {this.state.completedSteps.infection_done ? - + : ''} -
-
- 4. - Security Report + { + return (location.pathname === '/report/attack' + || location.pathname === '/report/zeroTrust' + || location.pathname === '/report/security') + }}> + 4. + Security Reports {this.state.completedSteps.report_done ? - + : ''} -
-
- 5. - Zero Trust Report - {this.state.completedSteps.report_done ? - -- : ''} -
- -
-
- + + Start Over
@@ -177,23 +180,23 @@ class AppComponent extends AuthComponent {
Configuration
- Log
+ Configuration
+ Log - {x} )} -
- {x} )} -
- {x.substr(0, 3) + '******'} )} -
- {x} )} -
- {x} )} -
- Stolen SSH keys are used to exploit other machines. : null} - {this.state.report.overview.issues[this.Issue.STOLEN_CREDS] ? -
- Stolen credentials are used to exploit other machines. : null} - {this.state.report.overview.issues[this.Issue.ELASTIC] ? -
- Elasticsearch servers are vulnerable to CVE-2015-1427. - : null} - {this.state.report.overview.issues[this.Issue.VSFTPD] ? -
- VSFTPD is vulnerable to CVE-2011-2523. - : null} - {this.state.report.overview.issues[this.Issue.SAMBACRY] ? -
- Samba servers are vulnerable to ‘SambaCry’ (CVE-2017-7494). : null} - {this.state.report.overview.issues[this.Issue.SHELLSHOCK] ? -
- Machines are vulnerable to ‘Shellshock’ (CVE-2014-6271). - : null} - {this.state.report.overview.issues[this.Issue.CONFICKER] ? -
- Machines are vulnerable to ‘Conficker’ (MS08-067). : null} - {this.state.report.overview.issues[this.Issue.WEAK_PASSWORD] ? -
- Machines are accessible using passwords supplied by the user during the Monkey’s - configuration. : null} - {this.state.report.overview.issues[this.Issue.AZURE] ? -
- Azure machines expose plaintext passwords. (More info) : null} - {this.state.report.overview.issues[this.Issue.STRUTS2] ? -
- Struts2 servers are vulnerable to remote code execution. ( - CVE-2017-5638) : null} - {this.state.report.overview.issues[this.Issue.WEBLOGIC] ? -
- Oracle WebLogic servers are susceptible to a remote code execution vulnerability. : null} - {this.state.report.overview.issues[this.Issue.HADOOP] ? -
- Hadoop/Yarn servers are vulnerable to remote code execution. : null} - {this.state.report.overview.issues[this.Issue.PTH_CRIT_SERVICES_ACCESS] ? -
- Mimikatz found login credentials of a user who has admin access to a server defined as - critical. : null} - {this.state.report.overview.issues[this.Issue.MSSQL] ? -
- MS-SQL servers are vulnerable to remote code execution via xp_cmdshell command. : null} -
- Weak segmentation - Machines from different segments are able to - communicate. : null} - {this.state.report.overview.warnings[this.Warning.TUNNEL] ? -
- Weak segmentation - Machines were able to communicate over unused ports. : null} - {this.state.report.overview.warnings[this.Warning.SHARED_LOCAL_ADMIN] ? -
- Shared local administrator account - Different machines have the same account as a local - administrator. : null} - {this.state.report.overview.warnings[this.Warning.SHARED_PASSWORDS] ? -
- Multiple users have the same password : null} -
-
- {'Communication possible from ' + crossSegmentIssue['source_subnet'] + ' to ' + crossSegmentIssue['target_subnet']}
-
- --
- {crossSegmentIssue['issues'].map(x =>
- x['is_self'] ?
-
- - {'Machine ' + x['hostname'] + ' has both ips: ' + x['source'] + ' and ' + x['target']} - - : -
- - {'IP ' + x['source'] + ' (' + x['hostname'] + ') connected to IP ' + x['target'] - + ' using the services: ' + Object.keys(x['services']).join(', ')} - - )} -
;
- }
-
- generateShellshockPathListBadges(paths) {
- return paths.map(path => {path});
- }
-
- generateSmbPasswordIssue(issue) {
- return (
- -
- Change {issue.username}'s password to a complex one-use password
- that is not shared with other computers on the network.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SMB attack. - -
- The Monkey authenticated over the SMB protocol with user {issue.username} and its password. -
- );
- }
-
- generateSmbPthIssue(issue) {
- return (
- -
- Change {issue.username}'s password to a complex one-use password
- that is not shared with other computers on the network.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SMB attack. - -
- The Monkey used a pass-the-hash attack over SMB protocol with user {issue.username}. -
- );
- }
-
- generateWmiPasswordIssue(issue) {
- return (
- -
- Change {issue.username}'s password to a complex one-use password
- that is not shared with other computers on the network.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a WMI attack. - -
- The Monkey authenticated over the WMI protocol with user {issue.username} and its password. -
- );
- }
-
- generateWmiPthIssue(issue) {
- return (
- -
- Change {issue.username}'s password to a complex one-use password
- that is not shared with other computers on the network.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a WMI attack. - -
- The Monkey used a pass-the-hash attack over WMI protocol with user {issue.username}. -
- );
- }
-
- generateSshIssue(issue) {
- return (
- -
- Change {issue.username}'s password to a complex one-use password
- that is not shared with other computers on the network.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SSH attack. - -
- The Monkey authenticated over the SSH protocol with user {issue.username} and its password. -
- );
- }
-
- generateSshKeysIssue(issue) {
- return (
- -
- Protect {issue.ssh_key} private key with a pass phrase.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SSH attack. - -
- The Monkey authenticated over the SSH protocol with private key {issue.ssh_key}. -
- );
- }
-
-
- generateSambaCryIssue(issue) {
- return (
- -
- Change {issue.username}'s password to a complex one-use password
- that is not shared with other computers on the network.
-
- Update your Samba server to 4.4.14 and up, 4.5.10 and up, or 4.6.4 and up. -- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SambaCry attack. - -
- The Monkey authenticated over the SMB protocol with user {issue.username} and its password, and used the SambaCry - vulnerability. -
- );
- }
-
- generateVsftpdBackdoorIssue(issue) {
- return (
- -
- Update your VSFTPD server to the latest version vsftpd-3.0.3.
-
- The machine {issue.machine} ({issue.ip_address}) has a backdoor running at port 6200. - -
- The attack was made possible because the VSFTPD server was not patched against CVE-2011-2523. -
In July 2011, it was discovered that vsftpd version 2.3.4 downloadable from the master site had been - compromised. - Users logging into a compromised vsftpd-2.3.4 server may issue a ":)" smileyface as the username and gain a command - shell on port 6200. -
- The Monkey executed commands by first logging in with ":)" in the username and then sending commands to the backdoor - at port 6200. -
Read more about the security issue and remediation here. -
- );
- }
-
- generateElasticIssue(issue) {
- return (
- -
- Update your Elastic Search server to version 1.4.3 and up.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to an Elastic Groovy attack. - -
- The attack was made possible because the Elastic Search server was not patched against CVE-2015-1427. -
- );
- }
-
- generateShellshockIssue(issue) {
- return (
- -
- Update your Bash to a ShellShock-patched version.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a ShellShock attack. - -
- The attack was made possible because the HTTP server running on TCP port {issue.port} was vulnerable to a shell injection attack on the - paths: {this.generateShellshockPathListBadges(issue.paths)}. -
- );
- }
-
- generateAzureIssue(issue) {
- return (
- -
- Delete VM Access plugin configuration files.
-
- Credentials could be stolen from {issue.machine} for the following users {issue.users}. Read more about the security issue and remediation here. - -
- );
- }
-
- generateConfickerIssue(issue) {
- return (
- -
- Install the latest Windows updates or upgrade to a newer operating system.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a Conficker attack. - -
- The attack was made possible because the target machine used an outdated and unpatched operating system - vulnerable to Conficker. -
- );
- }
-
- generateIslandCrossSegmentIssue(issue) {
- return (
- -
- Segment your network and make sure there is no communication between machines from different segments.
-
- The network can probably be segmented. A monkey instance on {issue.machine} in the - networks {this.generateInfoBadges(issue.networks)} - could directly access the Monkey Island server in the - networks {this.generateInfoBadges(issue.server_networks)}. - -
- );
- }
-
- generateSharedCredsDomainIssue(issue) {
- return (
- -
- Some domain users are sharing passwords, this should be fixed by changing passwords.
-
- These users are sharing access password: - {this.generateInfoBadges(issue.shared_with)}. - -
- );
- }
-
- generateSharedCredsIssue(issue) {
- return (
- -
- Some users are sharing passwords, this should be fixed by changing passwords.
-
- These users are sharing access password: - {this.generateInfoBadges(issue.shared_with)}. - -
- );
- }
-
- generateSharedLocalAdminsIssue(issue) {
- return (
- -
- Make sure the right administrator accounts are managing the right machines, and that there isn’t an unintentional local
- admin sharing.
-
- Here is a list of machines which the account {issue.username} is defined as an administrator: - {this.generateInfoBadges(issue.shared_machines)} - -
- );
- }
-
- generateStrongUsersOnCritIssue(issue) {
- return (
- -
- This critical machine is open to attacks via strong users with access to it.
-
- The services: {this.generateInfoBadges(issue.services)} have been found on the machine - thus classifying it as a critical machine. - These users has access to it: - {this.generateInfoBadges(issue.threatening_users)}. - -
- );
- }
-
- generateTunnelIssue(issue) {
- return (
- -
- Use micro-segmentation policies to disable communication other than the required.
-
- Machines are not locked down at port level. Network tunnel was set up from {issue.machine} to {issue.dest}. - -
- );
- }
-
- generateStruts2Issue(issue) {
- return (
- -
- Upgrade Struts2 to version 2.3.32 or 2.5.10.1 or any later versions.
-
- Struts2 server at {issue.machine} ({issue.ip_address}) is vulnerable to remote code execution attack. - -
- The attack was made possible because the server is using an old version of Jakarta based file upload - Multipart parser. For possible work-arounds and more info read here. -
- );
- }
-
- generateWebLogicIssue(issue) {
- return (
- -
- Update Oracle WebLogic server to the latest supported version.
-
- Oracle WebLogic server at {issue.machine} ({issue.ip_address}) is vulnerable to one of remote code execution attacks. - -
- The attack was made possible due to one of the following vulnerabilities: - CVE-2017-10271 or - CVE-2019-2725 -
- );
- }
-
- generateHadoopIssue(issue) {
- return (
- -
- Run Hadoop in secure mode (
- add Kerberos authentication).
-
- The Hadoop server at {issue.machine} ({issue.ip_address}) is vulnerable to remote code execution attack. - -
- The attack was made possible due to default Hadoop/Yarn configuration being insecure. -
- );
- }
-
- generateMSSQLIssue(issue) {
- return (
- -
- Disable the xp_cmdshell option.
-
- The machine {issue.machine} ({issue.ip_address}) is vulnerable to a MSSQL exploit attack. - -
- The attack was made possible because the target machine used an outdated MSSQL server configuration allowing - the usage of the xp_cmdshell command. To learn more about how to disable this feature, read - Microsoft's documentation. -
- );
- }
-
- generateIssue = (issue) => {
- let data;
- switch (issue.type) {
- case 'vsftp':
- data = this.generateVsftpdBackdoorIssue(issue);
- break;
- case 'smb_password':
- data = this.generateSmbPasswordIssue(issue);
- break;
- case 'smb_pth':
- data = this.generateSmbPthIssue(issue);
- break;
- case 'wmi_password':
- data = this.generateWmiPasswordIssue(issue);
- break;
- case 'wmi_pth':
- data = this.generateWmiPthIssue(issue);
- break;
- case 'ssh':
- data = this.generateSshIssue(issue);
- break;
- case 'ssh_key':
- data = this.generateSshKeysIssue(issue);
- break;
- case 'sambacry':
- data = this.generateSambaCryIssue(issue);
- break;
- case 'elastic':
- data = this.generateElasticIssue(issue);
- break;
- case 'shellshock':
- data = this.generateShellshockIssue(issue);
- break;
- case 'conficker':
- data = this.generateConfickerIssue(issue);
- break;
- case 'island_cross_segment':
- data = this.generateIslandCrossSegmentIssue(issue);
- break;
- case 'shared_passwords':
- data = this.generateSharedCredsIssue(issue);
- break;
- case 'shared_passwords_domain':
- data = this.generateSharedCredsDomainIssue(issue);
- break;
- case 'shared_admins_domain':
- data = this.generateSharedLocalAdminsIssue(issue);
- break;
- case 'strong_users_on_crit':
- data = this.generateStrongUsersOnCritIssue(issue);
- break;
- case 'tunnel':
- data = this.generateTunnelIssue(issue);
- break;
- case 'azure_password':
- data = this.generateAzureIssue(issue);
- break;
- case 'struts2':
- data = this.generateStruts2Issue(issue);
- break;
- case 'weblogic':
- data = this.generateWebLogicIssue(issue);
- break;
- case 'hadoop':
- data = this.generateHadoopIssue(issue);
- break;
- case 'mssql':
- data = this.generateMSSQLIssue(issue);
- break;
- }
- return data;
- };
-
- generateIssues = (issues) => {
- let issuesDivArray = [];
- for (let machine of Object.keys(issues)) {
- issuesDivArray.push(
- -
-
{machine}
--
- {issues[machine].map(this.generateIssue)}
-
- );
- }
- return - {x} )} +
- {x} )} +
- {x.substr(0, 3) + '******'} )} +
- {x} )} +
- {x} )} +
- Stolen SSH keys are used to exploit other machines. : null} + {this.state.report.overview.issues[this.Issue.STOLEN_CREDS] ? +
- Stolen credentials are used to exploit other machines. : null} + {this.state.report.overview.issues[this.Issue.ELASTIC] ? +
- Elasticsearch servers are vulnerable to CVE-2015-1427. + : null} + {this.state.report.overview.issues[this.Issue.VSFTPD] ? +
- VSFTPD is vulnerable to CVE-2011-2523. + : null} + {this.state.report.overview.issues[this.Issue.SAMBACRY] ? +
- Samba servers are vulnerable to ‘SambaCry’ (CVE-2017-7494). : null} + {this.state.report.overview.issues[this.Issue.SHELLSHOCK] ? +
- Machines are vulnerable to ‘Shellshock’ (CVE-2014-6271). + : null} + {this.state.report.overview.issues[this.Issue.CONFICKER] ? +
- Machines are vulnerable to ‘Conficker’ (MS08-067). : null} + {this.state.report.overview.issues[this.Issue.WEAK_PASSWORD] ? +
- Machines are accessible using passwords supplied by the user during the Monkey’s + configuration. : null} + {this.state.report.overview.issues[this.Issue.AZURE] ? +
- Azure machines expose plaintext passwords. (More info) : null} + {this.state.report.overview.issues[this.Issue.STRUTS2] ? +
- Struts2 servers are vulnerable to remote code execution. ( + CVE-2017-5638) : null} + {this.state.report.overview.issues[this.Issue.WEBLOGIC] ? +
- Oracle WebLogic servers are susceptible to a remote code execution vulnerability. : null} + {this.state.report.overview.issues[this.Issue.HADOOP] ? +
- Hadoop/Yarn servers are vulnerable to remote code execution. : null} + {this.state.report.overview.issues[this.Issue.PTH_CRIT_SERVICES_ACCESS] ? +
- Mimikatz found login credentials of a user who has admin access to a server defined as + critical. : null} + {this.state.report.overview.issues[this.Issue.MSSQL] ? +
- MS-SQL servers are vulnerable to remote code execution via xp_cmdshell command. : null} +
- Weak segmentation - Machines from different segments are able to + communicate. : null} + {this.state.report.overview.warnings[this.Warning.TUNNEL] ? +
- Weak segmentation - Machines were able to communicate over unused ports. : null} + {this.state.report.overview.warnings[this.Warning.SHARED_LOCAL_ADMIN] ? +
- Shared local administrator account - Different machines have the same account as a local + administrator. : null} + {this.state.report.overview.warnings[this.Warning.SHARED_PASSWORDS] ? +
- Multiple users have the same password : null} +
-
+ {'Communication possible from ' + crossSegmentIssue['source_subnet'] + ' to ' + crossSegmentIssue['target_subnet']}
+
+ +-
+ {crossSegmentIssue['issues'].map(x =>
+ x['is_self'] ?
+
- + {'Machine ' + x['hostname'] + ' has both ips: ' + x['source'] + ' and ' + x['target']} + + : +
- + {'IP ' + x['source'] + ' (' + x['hostname'] + ') connected to IP ' + x['target'] + + ' using the services: ' + Object.keys(x['services']).join(', ')} + + )} +
;
+ }
+
+ generateShellshockPathListBadges(paths) {
+ return paths.map(path => {path});
+ }
+
+ generateSmbPasswordIssue(issue) {
+ return (
+ -
+ Change {issue.username}'s password to a complex one-use password
+ that is not shared with other computers on the network.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SMB attack. + +
+ The Monkey authenticated over the SMB protocol with user {issue.username} and its password. +
+ );
+ }
+
+ generateSmbPthIssue(issue) {
+ return (
+ -
+ Change {issue.username}'s password to a complex one-use password
+ that is not shared with other computers on the network.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SMB attack. + +
+ The Monkey used a pass-the-hash attack over SMB protocol with user {issue.username}. +
+ );
+ }
+
+ generateWmiPasswordIssue(issue) {
+ return (
+ -
+ Change {issue.username}'s password to a complex one-use password
+ that is not shared with other computers on the network.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a WMI attack. + +
+ The Monkey authenticated over the WMI protocol with user {issue.username} and its password. +
+ );
+ }
+
+ generateWmiPthIssue(issue) {
+ return (
+ -
+ Change {issue.username}'s password to a complex one-use password
+ that is not shared with other computers on the network.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a WMI attack. + +
+ The Monkey used a pass-the-hash attack over WMI protocol with user {issue.username}. +
+ );
+ }
+
+ generateSshIssue(issue) {
+ return (
+ -
+ Change {issue.username}'s password to a complex one-use password
+ that is not shared with other computers on the network.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SSH attack. + +
+ The Monkey authenticated over the SSH protocol with user {issue.username} and its password. +
+ );
+ }
+
+ generateSshKeysIssue(issue) {
+ return (
+ -
+ Protect {issue.ssh_key} private key with a pass phrase.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SSH attack. + +
+ The Monkey authenticated over the SSH protocol with private key {issue.ssh_key}. +
+ );
+ }
+
+
+ generateSambaCryIssue(issue) {
+ return (
+ -
+ Change {issue.username}'s password to a complex one-use password
+ that is not shared with other computers on the network.
+
+ Update your Samba server to 4.4.14 and up, 4.5.10 and up, or 4.6.4 and up. ++ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a SambaCry attack. + +
+ The Monkey authenticated over the SMB protocol with user {issue.username} and its password, and used the SambaCry + vulnerability. +
+ );
+ }
+
+ generateVsftpdBackdoorIssue(issue) {
+ return (
+ -
+ Update your VSFTPD server to the latest version vsftpd-3.0.3.
+
+ The machine {issue.machine} ({issue.ip_address}) has a backdoor running at port 6200. + +
+ The attack was made possible because the VSFTPD server was not patched against CVE-2011-2523. +
In July 2011, it was discovered that vsftpd version 2.3.4 downloadable from the master site had been + compromised. + Users logging into a compromised vsftpd-2.3.4 server may issue a ":)" smileyface as the username and gain a command + shell on port 6200. +
+ The Monkey executed commands by first logging in with ":)" in the username and then sending commands to the backdoor + at port 6200. +
Read more about the security issue and remediation here. +
+ );
+ }
+
+ generateElasticIssue(issue) {
+ return (
+ -
+ Update your Elastic Search server to version 1.4.3 and up.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to an Elastic Groovy attack. + +
+ The attack was made possible because the Elastic Search server was not patched against CVE-2015-1427. +
+ );
+ }
+
+ generateShellshockIssue(issue) {
+ return (
+ -
+ Update your Bash to a ShellShock-patched version.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a ShellShock attack. + +
+ The attack was made possible because the HTTP server running on TCP port {issue.port} was vulnerable to a shell injection attack on the + paths: {this.generateShellshockPathListBadges(issue.paths)}. +
+ );
+ }
+
+ generateAzureIssue(issue) {
+ return (
+ -
+ Delete VM Access plugin configuration files.
+
+ Credentials could be stolen from {issue.machine} for the following users {issue.users}. Read more about the security issue and remediation here. + +
+ );
+ }
+
+ generateConfickerIssue(issue) {
+ return (
+ -
+ Install the latest Windows updates or upgrade to a newer operating system.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a Conficker attack. + +
+ The attack was made possible because the target machine used an outdated and unpatched operating system + vulnerable to Conficker. +
+ );
+ }
+
+ generateIslandCrossSegmentIssue(issue) {
+ return (
+ -
+ Segment your network and make sure there is no communication between machines from different segments.
+
+ The network can probably be segmented. A monkey instance on {issue.machine} in the + networks {this.generateInfoBadges(issue.networks)} + could directly access the Monkey Island server in the + networks {this.generateInfoBadges(issue.server_networks)}. + +
+ );
+ }
+
+ generateSharedCredsDomainIssue(issue) {
+ return (
+ -
+ Some domain users are sharing passwords, this should be fixed by changing passwords.
+
+ These users are sharing access password: + {this.generateInfoBadges(issue.shared_with)}. + +
+ );
+ }
+
+ generateSharedCredsIssue(issue) {
+ return (
+ -
+ Some users are sharing passwords, this should be fixed by changing passwords.
+
+ These users are sharing access password: + {this.generateInfoBadges(issue.shared_with)}. + +
+ );
+ }
+
+ generateSharedLocalAdminsIssue(issue) {
+ return (
+ -
+ Make sure the right administrator accounts are managing the right machines, and that there isn’t an unintentional local
+ admin sharing.
+
+ Here is a list of machines which the account {issue.username} is defined as an administrator: + {this.generateInfoBadges(issue.shared_machines)} + +
+ );
+ }
+
+ generateStrongUsersOnCritIssue(issue) {
+ return (
+ -
+ This critical machine is open to attacks via strong users with access to it.
+
+ The services: {this.generateInfoBadges(issue.services)} have been found on the machine + thus classifying it as a critical machine. + These users has access to it: + {this.generateInfoBadges(issue.threatening_users)}. + +
+ );
+ }
+
+ generateTunnelIssue(issue) {
+ return (
+ -
+ Use micro-segmentation policies to disable communication other than the required.
+
+ Machines are not locked down at port level. Network tunnel was set up from {issue.machine} to {issue.dest}. + +
+ );
+ }
+
+ generateStruts2Issue(issue) {
+ return (
+ -
+ Upgrade Struts2 to version 2.3.32 or 2.5.10.1 or any later versions.
+
+ Struts2 server at {issue.machine} ({issue.ip_address}) is vulnerable to remote code execution attack. + +
+ The attack was made possible because the server is using an old version of Jakarta based file upload + Multipart parser. For possible work-arounds and more info read here. +
+ );
+ }
+
+ generateWebLogicIssue(issue) {
+ return (
+ -
+ Update Oracle WebLogic server to the latest supported version.
+
+ Oracle WebLogic server at {issue.machine} ({issue.ip_address}) is vulnerable to one of remote code execution attacks. + +
+ The attack was made possible due to one of the following vulnerabilities: + CVE-2017-10271 or + CVE-2019-2725 +
+ );
+ }
+
+ generateHadoopIssue(issue) {
+ return (
+ -
+ Run Hadoop in secure mode (
+ add Kerberos authentication).
+
+ The Hadoop server at {issue.machine} ({issue.ip_address}) is vulnerable to remote code execution attack. + +
+ The attack was made possible due to default Hadoop/Yarn configuration being insecure. +
+ );
+ }
+
+ generateMSSQLIssue(issue) {
+ return (
+ -
+ Disable the xp_cmdshell option.
+
+ The machine {issue.machine} ({issue.ip_address}) is vulnerable to a MSSQL exploit attack. + +
+ The attack was made possible because the target machine used an outdated MSSQL server configuration allowing + the usage of the xp_cmdshell command. To learn more about how to disable this feature, read + Microsoft's documentation. +
+ );
+ }
+
+ generateIssue = (issue) => {
+ let data;
+ switch (issue.type) {
+ case 'vsftp':
+ data = this.generateVsftpdBackdoorIssue(issue);
+ break;
+ case 'smb_password':
+ data = this.generateSmbPasswordIssue(issue);
+ break;
+ case 'smb_pth':
+ data = this.generateSmbPthIssue(issue);
+ break;
+ case 'wmi_password':
+ data = this.generateWmiPasswordIssue(issue);
+ break;
+ case 'wmi_pth':
+ data = this.generateWmiPthIssue(issue);
+ break;
+ case 'ssh':
+ data = this.generateSshIssue(issue);
+ break;
+ case 'ssh_key':
+ data = this.generateSshKeysIssue(issue);
+ break;
+ case 'sambacry':
+ data = this.generateSambaCryIssue(issue);
+ break;
+ case 'elastic':
+ data = this.generateElasticIssue(issue);
+ break;
+ case 'shellshock':
+ data = this.generateShellshockIssue(issue);
+ break;
+ case 'conficker':
+ data = this.generateConfickerIssue(issue);
+ break;
+ case 'island_cross_segment':
+ data = this.generateIslandCrossSegmentIssue(issue);
+ break;
+ case 'shared_passwords':
+ data = this.generateSharedCredsIssue(issue);
+ break;
+ case 'shared_passwords_domain':
+ data = this.generateSharedCredsDomainIssue(issue);
+ break;
+ case 'shared_admins_domain':
+ data = this.generateSharedLocalAdminsIssue(issue);
+ break;
+ case 'strong_users_on_crit':
+ data = this.generateStrongUsersOnCritIssue(issue);
+ break;
+ case 'tunnel':
+ data = this.generateTunnelIssue(issue);
+ break;
+ case 'azure_password':
+ data = this.generateAzureIssue(issue);
+ break;
+ case 'struts2':
+ data = this.generateStruts2Issue(issue);
+ break;
+ case 'weblogic':
+ data = this.generateWebLogicIssue(issue);
+ break;
+ case 'hadoop':
+ data = this.generateHadoopIssue(issue);
+ break;
+ case 'mssql':
+ data = this.generateMSSQLIssue(issue);
+ break;
+ }
+ return data;
+ };
+
+ generateIssues = (issues) => {
+ let issuesDivArray = [];
+ for (let machine of Object.keys(issues)) {
+ issuesDivArray.push(
+ -
+
{machine}
+-
+ {issues[machine].map(this.generateIssue)}
+
+ );
+ }
+ return
-
-
-
+
-
- License
+ ()}/>
{this.renderRoute('/', , true)}
{this.renderRoute('/configure', )}
@@ -201,8 +204,12 @@ class AppComponent extends AuthComponent {
{this.renderRoute('/infection/map', )}
{this.renderRoute('/infection/telemetry', )}
{this.renderRoute('/start-over', )}
- {this.renderRoute('/report/security', )}
- {this.renderRoute(reportZeroTrustRoute, )}
+ {this.redirectTo('/report', '/report/security')}
+
+ {this.renderRoute('/report/security',
{this.renderRoute('/license', )}
diff --git a/monkey/monkey_island/cc/ui/src/components/attack/MatrixComponent.js b/monkey/monkey_island/cc/ui/src/components/attack/ConfigMatrixComponent.js
similarity index 78%
rename from monkey/monkey_island/cc/ui/src/components/attack/MatrixComponent.js
rename to monkey/monkey_island/cc/ui/src/components/attack/ConfigMatrixComponent.js
index 29ab3497a..d6fd2d12a 100644
--- a/monkey/monkey_island/cc/ui/src/components/attack/MatrixComponent.js
+++ b/monkey/monkey_island/cc/ui/src/components/attack/ConfigMatrixComponent.js
@@ -7,7 +7,11 @@ import 'filepond/dist/filepond.min.css';
import '../../styles/Tooltip.scss';
import {Col} from 'react-bootstrap';
-class MatrixComponent extends AuthComponent {
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { faCircle as faCircle } from '@fortawesome/free-solid-svg-icons';
+import { faCircle as faCircleThin } from '@fortawesome/free-regular-svg-icons';
+
+class ConfigMatrixComponent extends AuthComponent {
constructor(props) {
super(props);
this.state = {lastAction: 'none'}
@@ -37,12 +41,12 @@ class MatrixComponent extends AuthComponent {
if (i <= Object.keys(techType.properties).length) {
rowColumn.technique = Object.values(techType.properties)[i];
if (rowColumn.technique) {
- rowColumn.technique.name = Object.keys(techType.properties)[i]
+ rowColumn.technique.name = Object.keys(techType.properties)[i];
}
} else {
- rowColumn.technique = null
+ rowColumn.technique = null;
}
- row[rowColumn.techName] = rowColumn
+ row[rowColumn.techName] = rowColumn;
});
techniques.push(row)
}
@@ -77,8 +81,8 @@ class MatrixComponent extends AuthComponent {
getTableData = (config) => {
let configCopy = JSON.parse(JSON.stringify(config));
- let maxTechniques = MatrixComponent.findMaxTechniques(Object.values(configCopy));
- let matrixTableData = MatrixComponent.parseTechniques(Object.values(configCopy), maxTechniques);
+ let maxTechniques = ConfigMatrixComponent.findMaxTechniques(Object.values(configCopy));
+ let matrixTableData = ConfigMatrixComponent.parseTechniques(Object.values(configCopy), maxTechniques);
let columns = this.getColumns(matrixTableData);
return {'columns': columns, 'matrixTableData': matrixTableData, 'maxTechniques': maxTechniques}
};
@@ -87,15 +91,15 @@ class MatrixComponent extends AuthComponent {
return (
+ License
{!info ?
- )
+ return ()
};
diff --git a/monkey/monkey_island/cc/ui/src/components/pages/MapPage.js b/monkey/monkey_island/cc/ui/src/components/pages/MapPage.js
index d8a79cdca..278b4c791 100644
--- a/monkey/monkey_island/cc/ui/src/components/pages/MapPage.js
+++ b/monkey/monkey_island/cc/ui/src/components/pages/MapPage.js
@@ -1,7 +1,8 @@
import React from 'react';
import {Col, Modal} from 'react-bootstrap';
import {Link} from 'react-router-dom';
-import {Icon} from 'react-fa';
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome'
+import { faStopCircle, faMinus } from '@fortawesome/free-solid-svg-icons'
import InfMapPreviewPaneComponent from 'components/map/preview-pane/InfMapPreviewPane';
import {ReactiveGraph} from 'components/reactive-graph/ReactiveGraph';
import {options, edgeGroupToColor} from 'components/map/MapOptions';
@@ -157,13 +158,13 @@ class MapPageComponent extends AuthComponent {
(
+ )}/>)
+ };
+
+ renderNavButton = (section) => {
+ return (
+ {}}>
+ {section.title}
+ )};
+
+ getReportContent() {
+ switch(this.state.selectedSection){
+ case 'security':
+ return ();
+ case 'attack':
+ return ();
+ case 'zeroTrust':
+ return ();
}
}
- generateReportContent() {
+ render() {
let content;
- if (this.stillLoadingDataFromServer()) {
- content = ;
+ if (this.state.runStarted) {
+ content = this.getReportContent();
} else {
- content =
-
- ;
- } else {
- content =
-
- )
- }
-
- stillLoadingDataFromServer() {
- return typeof this.state.findings === 'undefined'
- || typeof this.state.pillars === 'undefined'
- || typeof this.state.principles === 'undefined';
- }
-
- getZeroTrustReportFromServer() {
- this.authFetch('/api/report/zero_trust/findings')
- .then(res => res.json())
- .then(res => {
- this.setState({
- findings: res
- });
- });
- this.authFetch('/api/report/zero_trust/principles')
- .then(res => res.json())
- .then(res => {
- this.setState({
- principles: res
- });
- });
- this.authFetch('/api/report/zero_trust/pillars')
- .then(res => res.json())
- .then(res => {
- this.setState({
- pillars: res
- });
- });
- }
-}
-
-export default ZeroTrustReportPageComponent;
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
new file mode 100644
index 000000000..39886fee6
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/AttackReport.js
@@ -0,0 +1,166 @@
+import React from 'react';
+import {Col, Button} from 'react-bootstrap';
+import '../../styles/Collapse.scss';
+import '../../styles/report/AttackReport.scss';
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import {faCircle, faEye, faEyeSlash, faRadiation} from '@fortawesome/free-solid-svg-icons';
+
+import ReportHeader, {ReportTypes} from './common/ReportHeader';
+import {ScanStatus} from '../attack/techniques/Helpers';
+import Matrix from './attack/ReportMatrixComponent';
+import SelectedTechnique from './attack/SelectedTechnique';
+import TechniqueDropdowns from './attack/TechniqueDropdowns';
+import ReportLoader from './common/ReportLoader';
+
+const techComponents = getAllAttackModules();
+
+function getAllAttackModules() {
+ let context = require.context('../attack/techniques/', false, /\.js$/);
+ let obj = {};
+ context.keys().forEach(function (key) {
+ let techName = key.replace(/\.js/, '');
+ techName = String(techName.replace(/\.\//, ''));
+ obj[techName] = context(key).default;
+ });
+ return obj;
+}
+
+class AttackReport extends React.Component {
+
+ constructor(props) {
+ super(props);
+ this.state = {
+ selectedTechnique: false,
+ collapseOpen: ''
+ };
+ if (typeof this.props.report.schema !== 'undefined' && typeof this.props.report.techniques !== 'undefined'){
+ this.state['schema'] = this.props.report['schema'];
+ this.state['techniques'] = AttackReport.addLinksToTechniques(this.props.report['schema'], this.props.report['techniques']);
+ }
+ }
+
+ componentDidUpdate(prevProps) {
+ if (this.props.report !== prevProps.report) {
+ this.setState({schema: this.props.report['schema'],
+ techniques: AttackReport.addLinksToTechniques(this.props.report['schema'], this.props.report['techniques'])})
+ }
+ }
+
+ onTechniqueSelect = (technique, value) => {
+ let selectedTechnique = this.getTechniqueByTitle(technique);
+ if (selectedTechnique === false){
+ return;
+ }
+ this.setState({selectedTechnique: selectedTechnique.tech_id})
+ };
+
+ static getComponentClass(tech_id, techniques) {
+ switch (techniques[tech_id].status) {
+ case ScanStatus.SCANNED:
+ return 'collapse-info';
+ case ScanStatus.USED:
+ return 'collapse-danger';
+ default:
+ return 'collapse-default';
+ }
+ }
+
+ static getStatusIcon(tech_id, techniques){
+ switch (techniques[tech_id].status){
+ case ScanStatus.SCANNED:
+ return ;
+ case ScanStatus.USED:
+ return ;
+ default:
+ return ;
+ }
+ }
+
+ renderLegend() {
+ return (;
+ } else {
+ content =
+
+
+ );
+ }
+
+ stillLoadingDataFromServer() {
+ return Object.keys(this.state.report).length === 0;
+ }
+
+ updateMapFromServer = () => {
+ this.authFetch('/api/netmap')
+ .then(res => res.json())
+ .then(res => {
+ res.edges.forEach(edge => {
+ edge.color = {'color': edgeGroupToColor(edge.group)};
+ });
+ this.setState({graph: res});
+ });
+ };
+
+
+ generateReportOverviewSection() {
+ return (
+ ;
+ } else {
+ content =
+
+ )
+ }
+
+ stillLoadingDataFromServer() {
+ return typeof this.state.findings === 'undefined'
+ || typeof this.state.pillars === 'undefined'
+ || typeof this.state.principles === 'undefined';
+ }
+
+
+}
+
+export default ZeroTrustReportPageComponent;
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/attack/ReportMatrixComponent.js b/monkey/monkey_island/cc/ui/src/components/report-components/attack/ReportMatrixComponent.js
new file mode 100644
index 000000000..9be5d5f0b
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/attack/ReportMatrixComponent.js
@@ -0,0 +1,84 @@
+import React from 'react';
+
+import Checkbox from '../../ui-components/Checkbox';
+import ReactTable from 'react-table';
+import 'filepond/dist/filepond.min.css';
+import '../../../styles/report/ReportAttackMatrix.scss';
+
+class ReportMatrixComponent extends React.Component {
+ constructor(props) {
+ super(props);
+ this.state = {techniques: this.props.techniques,
+ schema: this.props.schema};
+ }
+
+ getColumns() {
+ let columns = [];
+ for(const type_key in this.state.schema.properties){
+ if (! this.state.schema.properties.hasOwnProperty(type_key)){
+ continue;
+ }
+ let tech_type = this.state.schema.properties[type_key];
+ columns.push({
+ Header: () => ({tech_type.title}),
+ id: type_key,
+ accessor: x => this.renderTechnique(x[tech_type.title]),
+ style: {'whiteSpace': 'unset'}
+ });
+ }
+ return columns;
+ }
+
+ getTableRows() {
+ let rows = [];
+ for (const tech_id in this.state.techniques) {
+ if (this.state.techniques.hasOwnProperty(tech_id)){
+ let technique_added = false;
+ let technique = this.state.techniques[tech_id];
+ for(const row of rows){
+ if (! row.hasOwnProperty(technique.type)){
+ row[technique.type] = technique;
+ technique_added = true;
+ break;
+ }
+ }
+ if (! technique_added){
+ let newRow = {};
+ newRow[technique.type] = technique;
+ rows.push(newRow)
+ }
+ }
+ }
+ return rows;
+ }
+
+ renderTechnique(technique) {
+ if (technique == null || typeof technique === undefined) {
+ return ()
+ } else {
+ return (
+
+ {technique.title}
+ )
+ }
+ }
+
+ render() {
+ let tableRows = this.getTableRows();
+ return (
+
;
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/ExportEventsButton.js b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/ExportEventsButton.js
index 4e49606e8..11b47a86f 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/ExportEventsButton.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/ExportEventsButton.js
@@ -2,12 +2,15 @@ import React, {Component} from 'react';
import {Button} from 'react-bootstrap';
import * as PropTypes from 'prop-types';
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { faDownload } from '@fortawesome/free-solid-svg-icons';
+
export default class ExportEventsButton extends Component {
render() {
return
}
}
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/PillarLabel.js b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/PillarLabel.js
index 639933012..b4a26f1a0 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/PillarLabel.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/PillarLabel.js
@@ -2,21 +2,24 @@ import React, {Component} from 'react';
import {statusToLabelType} from './StatusLabel';
import * as PropTypes from 'prop-types';
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { faDatabase, faUser, faWifi, faCloud, faLaptop, faEyeSlash, faCogs } from '@fortawesome/free-solid-svg-icons';
+
const pillarToIcon = {
- 'Data': 'fa fa-database',
- 'People': 'fa fa-user',
- 'Networks': 'fa fa-wifi',
- 'Workloads': 'fa fa-cloud',
- 'Devices': 'fa fa-laptop',
- 'Visibility & Analytics': 'fa fa-eye-slash',
- 'Automation & Orchestration': 'fa fa-cogs'
+ 'Data': faDatabase,
+ 'People': faUser,
+ 'Networks': faWifi,
+ 'Workloads': faCloud,
+ 'Devices': faLaptop,
+ 'Visibility & Analytics': faEyeSlash,
+ 'Automation & Orchestration': faCogs
};
export default class PillarLabel extends Component {
render() {
const className = 'label ' + statusToLabelType[this.props.status];
- return ;
+ return ;
},
maxWidth: MAX_WIDTH_STATUS_COLUMN
},
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/ReportLegend.js b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/ReportLegend.js
index f7eb8b9c8..2d74b9487 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/ReportLegend.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/ReportLegend.js
@@ -4,6 +4,9 @@ import {ZeroTrustStatuses} from './ZeroTrustPillars';
import {NavLink} from 'react-router-dom';
import {Panel} from 'react-bootstrap';
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { faChevronDown } from '@fortawesome/free-solid-svg-icons';
+
class ZeroTrustReportLegend extends Component {
render() {
@@ -13,7 +16,7 @@ class ZeroTrustReportLegend extends Component {
-
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/SinglePillarPrinciplesStatus.js b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/SinglePillarPrinciplesStatus.js
index fc1cc3f58..3838c3330 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/SinglePillarPrinciplesStatus.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/SinglePillarPrinciplesStatus.js
@@ -5,6 +5,9 @@ import React from 'react';
import * as PropTypes from 'prop-types';
import {Panel} from 'react-bootstrap';
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { faChevronDown } from '@fortawesome/free-solid-svg-icons';
+
export default class SinglePillarPrinciplesStatus extends AuthComponent {
render() {
if (this.props.principlesStatus.length === 0) {
@@ -15,7 +18,7 @@ export default class SinglePillarPrinciplesStatus extends AuthComponent {
-
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/StatusLabel.js b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/StatusLabel.js
index f94c4e41a..35ccffdc4 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/StatusLabel.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/StatusLabel.js
@@ -1,11 +1,14 @@
import React, {Component} from 'react';
import * as PropTypes from 'prop-types';
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { faCheck, faExclamationTriangle, faBomb, faQuestion } from '@fortawesome/free-solid-svg-icons';
+
const statusToIcon = {
- 'Passed': 'fa-check',
- 'Verify': 'fa-exclamation-triangle',
- 'Failed': 'fa-bomb',
- 'Unexecuted': 'fa-question'
+ 'Passed': faCheck,
+ 'Verify': faExclamationTriangle,
+ 'Failed': faBomb,
+ 'Unexecuted': faQuestion
};
export const statusToLabelType = {
@@ -24,7 +27,7 @@ export default class StatusLabel extends Component {
return (
-
-
@@ -36,6 +34,5 @@ export default class SummarySection extends Component {
}
SummarySection.propTypes = {
- allMonkeysAreDead: PropTypes.bool,
pillars: PropTypes.object
};
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/venn-components/VennDiagram.css b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/venn-components/VennDiagram.css
index dd4883125..08fdabe76 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/venn-components/VennDiagram.css
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/venn-components/VennDiagram.css
@@ -1,4 +1,5 @@
@import url('https://fonts.googleapis.com/css?family=Noto+Sans&display=swap');
+@import url('//netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css');
body {
margin: 0;
@@ -6,12 +7,10 @@ body {
}
svg {
-
-webkit-touch-callout: none; /* iOS Safari */
-webkit-user-select: none; /* Safari */
-khtml-user-select: none; /* Konqueror HTML */
-moz-user-select: none; /* Firefox */
-ms-user-select: none; /* Internet Explorer/Edge */
user-select: none; /* Non-prefixed version, currently supported by Chrome and Opera */
-
}
diff --git a/monkey/monkey_island/cc/ui/src/components/side-menu/VersionComponent.js b/monkey/monkey_island/cc/ui/src/components/side-menu/VersionComponent.js
index 18d711a0f..aa52e06bc 100644
--- a/monkey/monkey_island/cc/ui/src/components/side-menu/VersionComponent.js
+++ b/monkey/monkey_island/cc/ui/src/components/side-menu/VersionComponent.js
@@ -1,5 +1,7 @@
import React from 'react';
-import {Icon} from 'react-fa';
+
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { faDownload } from '@fortawesome/free-solid-svg-icons';
class VersionComponent extends React.Component {
constructor(props) {
@@ -32,7 +34,7 @@ class VersionComponent extends React.Component {
:
undefined
diff --git a/monkey/monkey_island/cc/ui/src/components/ui-components/Checkbox.js b/monkey/monkey_island/cc/ui/src/components/ui-components/Checkbox.js
index e143e0aba..6d2d0c035 100644
--- a/monkey/monkey_island/cc/ui/src/components/ui-components/Checkbox.js
+++ b/monkey/monkey_island/cc/ui/src/components/ui-components/Checkbox.js
@@ -14,10 +14,18 @@ class CheckboxComponent extends React.PureComponent {
changeHandler(name, checked) function will be called with these parameters:
this.props.name (the name of this component) and
this.state.checked (boolean indicating if this component is checked or not)
+
+ this.props.status (int) adds a class "status-x" to this checkbox. Used for styling.
*/
constructor(props) {
super(props);
+ if (this.props.hasOwnProperty('status')){
+ this.status = this.props.status;
+ } else {
+ this.status = false
+ }
this.state = {
+ status: this.status,
checked: this.props.checked,
necessary: this.props.necessary,
isAnimating: false
@@ -48,6 +56,9 @@ class CheckboxComponent extends React.PureComponent {
// Creates class string for component
composeStateClasses(core) {
let result = core;
+ if (this.state.status !== false) {
+ result += ' status-'+this.state.status;
+ }
if (this.state.necessary) {
return result + ' blocked'
}
@@ -56,7 +67,6 @@ class CheckboxComponent extends React.PureComponent {
} else {
result += ' is-unchecked'
}
-
if (this.state.isAnimating) {
result += ' do-ping';
}
@@ -69,11 +79,11 @@ class CheckboxComponent extends React.PureComponent {
Legend:
- Exploit
+ Exploit
{this.renderTelemetryConsole()}
@@ -180,7 +181,7 @@ class MapPageComponent extends AuthComponent {
Telemetry
diff --git a/monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js b/monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js
index 0cc17eb9f..451b69213 100644
--- a/monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js
+++ b/monkey/monkey_island/cc/ui/src/components/pages/ReportPage.js
@@ -1,97 +1,90 @@
-import React, {Fragment} from 'react';
-import {Button, Col} from 'react-bootstrap';
-import BreachedServers from 'components/report-components/security/BreachedServers';
-import ScannedServers from 'components/report-components/security/ScannedServers';
-import PostBreach from 'components/report-components/security/PostBreach';
+import '../../styles/report/ReportPage.scss';
+
+import React from 'react';
+import {Route} from 'react-router-dom';
+import {Col, Nav, NavItem} from 'react-bootstrap';
import {ReactiveGraph} from 'components/reactive-graph/ReactiveGraph';
import {edgeGroupToColor, options} from 'components/map/MapOptions';
-import StolenPasswords from 'components/report-components/security/StolenPasswords';
-import CollapsibleWellComponent from 'components/report-components/security/CollapsibleWell';
-import {Line} from 'rc-progress';
import AuthComponent from '../AuthComponent';
-import PassTheHashMapPageComponent from './PassTheHashMapPage';
-import StrongUsers from 'components/report-components/security/StrongUsers';
-import AttackReport from 'components/report-components/security/AttackReport';
-import ReportHeader, {ReportTypes} from '../report-components/common/ReportHeader';
-import MonkeysStillAliveWarning from '../report-components/common/MonkeysStillAliveWarning';
-import ReportLoader from '../report-components/common/ReportLoader';
import MustRunMonkeyWarning from '../report-components/common/MustRunMonkeyWarning';
-import SecurityIssuesGlance from '../report-components/common/SecurityIssuesGlance';
-import PrintReportButton from '../report-components/common/PrintReportButton';
+import AttackReport from '../report-components/AttackReport'
+import SecurityReport from '../report-components/SecurityReport'
+import ZeroTrustReport from '../report-components/ZeroTrustReport'
import {extractExecutionStatusFromServerResponse} from '../report-components/common/ExecutionStatus';
-
-let guardicoreLogoImage = require('../../images/guardicore-logo.png');
+import MonkeysStillAliveWarning from '../report-components/common/MonkeysStillAliveWarning';
class ReportPageComponent extends AuthComponent {
- Issue =
- {
- WEAK_PASSWORD: 0,
- STOLEN_CREDS: 1,
- ELASTIC: 2,
- SAMBACRY: 3,
- SHELLSHOCK: 4,
- CONFICKER: 5,
- AZURE: 6,
- STOLEN_SSH_KEYS: 7,
- STRUTS2: 8,
- WEBLOGIC: 9,
- HADOOP: 10,
- PTH_CRIT_SERVICES_ACCESS: 11,
- MSSQL: 12,
- VSFTPD: 13
- };
-
- Warning =
- {
- CROSS_SEGMENT: 0,
- TUNNEL: 1,
- SHARED_LOCAL_ADMIN: 2,
- SHARED_PASSWORDS: 3,
- SHARED_PASSWORDS_DOMAIN: 4
- };
-
constructor(props) {
super(props);
+ this.sectionsOrder = ['security', 'zeroTrust', 'attack'];
this.state = {
- report: {},
- graph: {nodes: [], edges: []},
+ securityReport: {},
+ attackReport: {},
+ zeroTrustReport: {},
allMonkeysAreDead: false,
- runStarted: true
+ runStarted: true,
+ selectedSection: ReportPageComponent.selectReport(this.sectionsOrder),
+ sections: [{key: 'security', title: 'Security report'},
+ {key: 'zeroTrust', title: 'Zero trust report'},
+ {key: 'attack', title: 'ATT&CK report'}]
};
}
- componentDidMount() {
- this.updateMonkeysRunning().then(res => this.getReportFromServer(res));
- this.updateMapFromServer();
+ static selectReport(reports){
+ let url = window.location.href;
+ for (let report_name in reports){
+ if (reports.hasOwnProperty(report_name) && url.endsWith(reports[report_name])){
+ return reports[report_name];
+ }
+ }
}
+ getReportFromServer(res) {
+ if (res['completed_steps']['run_monkey']) {
+ this.authFetch('/api/report/security')
+ .then(res => res.json())
+ .then(res => {
+ this.setState({
+ securityReport: res
+ });
+ });
+ this.authFetch('/api/attack/report')
+ .then(res => res.json())
+ .then(res => {
+ this.setState({
+ attackReport: res
+ });
+ });
+ this.getZeroTrustReportFromServer().then((ztReport) => {
+ this.setState({zeroTrustReport: ztReport})
+ });
+ }
+ }
+
+ getZeroTrustReportFromServer = async () => {
+ let ztReport = {findings: {}, principles: {}, pillars: {}};
+ await this.authFetch('/api/report/zero_trust/findings')
+ .then(res => res.json())
+ .then(res => {
+ ztReport.findings = res;
+ });
+ await this.authFetch('/api/report/zero_trust/principles')
+ .then(res => res.json())
+ .then(res => {
+ ztReport.principles = res;
+ });
+ await this.authFetch('/api/report/zero_trust/pillars')
+ .then(res => res.json())
+ .then(res => {
+ ztReport.pillars = res;
+ });
+ return ztReport
+ };
+
componentWillUnmount() {
- clearInterval(this.interval);
- }
-
- render() {
- let content;
-
- if (this.state.runStarted) {
- content = this.generateReportContent();
- } else {
- content = 4. Security Report
-
- {content}
-
-
- );
- }
-
- stillLoadingDataFromServer() {
- return Object.keys(this.state.report).length === 0;
+ clearInterval(this.state.ztReportRefreshInterval);
}
updateMonkeysRunning = () => {
@@ -103,890 +96,67 @@ class ReportPageComponent extends AuthComponent {
});
};
- updateMapFromServer = () => {
- this.authFetch('/api/netmap')
- .then(res => res.json())
- .then(res => {
- res.edges.forEach(edge => {
- edge.color = {'color': edgeGroupToColor(edge.group)};
- });
- this.setState({graph: res});
- this.props.onStatusChange();
- });
+ componentDidMount() {
+ const ztReportRefreshInterval = setInterval(this.updateZeroTrustReportFromServer, 8000);
+ this.setState({ztReportRefreshInterval: ztReportRefreshInterval});
+ this.updateMonkeysRunning().then(res => this.getReportFromServer(res));
+ }
+
+ setSelectedSection = (key) => {
+ this.setState({
+ selectedSection: key
+ });
};
- getReportFromServer(res) {
- if (res['completed_steps']['run_monkey']) {
- this.authFetch('/api/report/security')
- .then(res => res.json())
- .then(res => {
- this.setState({
- report: res
- });
- });
+ renderNav = () => {
+ return (
+
- {this.generateReportOverviewSection()}
- {this.generateReportFindingsSection()}
- {this.generateReportRecommendationsSection()}
- {this.generateReportGlanceSection()}
- {this.generateAttackSection()}
- {this.generateReportFooter()}
-
;
+ content =
- {
- print();
- }}/>
-
-
-
-
+
+
diff --git a/monkey/monkey_island/cc/ui/src/components/pages/ZeroTrustReportPage.js b/monkey/monkey_island/cc/ui/src/components/pages/ZeroTrustReportPage.js
deleted file mode 100755
index 2b2200c86..000000000
--- a/monkey/monkey_island/cc/ui/src/components/pages/ZeroTrustReportPage.js
+++ /dev/null
@@ -1,133 +0,0 @@
-import React, {Fragment} from 'react';
-import {Col} from 'react-bootstrap';
-import AuthComponent from '../AuthComponent';
-import ReportHeader, {ReportTypes} from '../report-components/common/ReportHeader';
-import ReportLoader from '../report-components/common/ReportLoader';
-import MustRunMonkeyWarning from '../report-components/common/MustRunMonkeyWarning';
-import PrintReportButton from '../report-components/common/PrintReportButton';
-import {extractExecutionStatusFromServerResponse} from '../report-components/common/ExecutionStatus';
-import SummarySection from '../report-components/zerotrust/SummarySection';
-import FindingsSection from '../report-components/zerotrust/FindingsSection';
-import PrinciplesSection from '../report-components/zerotrust/PrinciplesSection';
-
-class ZeroTrustReportPageComponent extends AuthComponent {
-
- constructor(props) {
- super(props);
-
- this.state = {
- allMonkeysAreDead: false,
- runStarted: true
- };
- }
-
- componentDidMount() {
- this.updatePageState();
- const refreshInterval = setInterval(this.updatePageState, 60000);
- this.setState(
- {refreshDataIntervalHandler: refreshInterval}
- )
- }
-
- componentWillUnmount() {
- clearInterval(this.state.refreshDataIntervalHandler);
- }
-
- updateMonkeysRunning = () => {
- return this.authFetch('/api')
- .then(res => res.json())
- .then(res => {
- this.setState(extractExecutionStatusFromServerResponse(res));
- return res;
- });
- };
-
- updatePageState = () => {
- this.updateMonkeysRunning().then(res => this.getZeroTrustReportFromServer(res));
- };
-
- render() {
- let content;
- if (this.state.runStarted) {
- content = this.generateReportContent();
- } else {
- content = +
4. Security Reports
+ {this.renderNav()} +
{content}
-
- {
- print();
- }}/>
-
-
+
);
}
-
- generateReportOverviewSection() {
- return (
-
- 0}/>
-
- {
- this.state.report.glance.exploited.length > 0 ?
- ''
- :
-
- );
- }
-
- generateReportFindingsSection() {
- return (
- - Overview -
-- - To improve the monkey's detection rates, try adding users and passwords and enable the "Local - network - scan" config value under Basic - Network. -
- } -- The first monkey run was started on {this.state.report.overview.monkey_start_time}. After {this.state.report.overview.monkey_duration}, all monkeys finished - propagation attempts. -
-- The monkey started propagating from the following machines where it was manually installed: -
-
- {this.state.report.overview.manual_monkeys.map(x =>
- The monkeys were run with the following configuration: -
- { - this.state.report.overview.config_users.length > 0 ? -- Usernames used for brute-forcing: -
-
- {this.state.report.overview.config_users.map(x =>
-
- {this.state.report.overview.config_passwords.map(x =>
- Brute forcing uses stolen credentials only. No credentials were supplied during Monkey’s - configuration. -
- } - { - this.state.report.overview.config_exploits.length > 0 ? - ( - this.state.report.overview.config_exploits[0] === 'default' ? - '' - : -- The Monkey uses the following exploit methods: -
-
- {this.state.report.overview.config_exploits.map(x =>
- No exploits are used by the Monkey. -
- } - { - this.state.report.overview.config_ips.length > 0 ? -- The Monkey scans the following IPs: -
-
- {this.state.report.overview.config_ips.map(x =>
- Note: Monkeys were configured to avoid scanning of the local network. -
- } -
-
- );
- }
-
- generateReportRecommendationsSection() {
- return (
- - Security Findings -
-
-
- - Immediate Threats -
- { - this.state.report.overview.issues.filter(function (x) { - return x === true; - }).length > 0 ? -
- During this simulated attack the Monkey uncovered
- {this.state.report.overview.issues.filter(function (x) {
- return x === true;
- }).length} threats:
-
- :
- -
- {this.state.report.overview.issues[this.Issue.STOLEN_SSH_KEYS] ?
-
- During this simulated attack the Monkey uncovered 0 threats.
-
- }
-
-
- {this.state.report.overview.cross_segment_issues.length > 0 ?
- - Potential Security Issues -
- { - this.state.report.overview.warnings.filter(function (x) { - return x === true; - }).length > 0 ? -
- The Monkey uncovered the following possible set of issues:
-
- :
- -
- {this.state.report.overview.warnings[this.Warning.CROSS_SEGMENT] ?
-
- The Monkey did not find any issues.
-
- }
-
-
- :
- ''
- }
- - Segmentation Issues -
-
- The Monkey uncovered the following set of segmentation issues:
-
- -
- {this.state.report.overview.cross_segment_issues.map(x => this.generateCrossSegmentIssue(x))}
-
- {/* Checks if there are any domain issues. If there are more then one: render the title. Otherwise,
- * don't render it (since the issues themselves will be empty. */}
- {Object.keys(this.state.report.recommendations.domain_issues).length !== 0 ?
-
- );
- }
-
-
- generateReportGlanceSection() {
- let exploitPercentage =
- (100 * this.state.report.glance.exploited.length) / this.state.report.glance.scanned.length;
- return (
- Domain related recommendations
: null} -
- {this.generateIssues(this.state.report.recommendations.domain_issues)}
-
- {/* Checks if there are any issues. If there are more then one: render the title. Otherwise,
- * don't render it (since the issues themselves will be empty. */}
- {Object.keys(this.state.report.recommendations.issues).length !== 0 ?
- Machine related recommendations
: null} -
- {this.generateIssues(this.state.report.recommendations.issues)}
-
-
-
- );
- }
-
- generateReportPthMap() {
- return (
- - The Network from the Monkey's Eyes -
-
-
- - The Monkey discovered {this.state.report.glance.scanned.length} machines and - successfully breached {this.state.report.glance.exploited.length} of them. -
-
-
- - From the attacker's point of view, the network looks like this: -
-
- Legend:
- Exploit
- |
- Scan
- |
- Tunnel
- |
- Island Communication
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- {this.generateReportPthMap()}
-
-
-
-
-
-
-
-
-
-
- );
- }
-
- generateAttackSection() {
- return (- Credentials Map -
-- This map visualizes possible attack paths through the network using credential compromise. Paths represent lateral - movement opportunities by attackers. -
-
- Legend:
- Access credentials |
-
-
-
-
- -
-
-
)
- }
-
- generateReportFooter() {
- return (
- - ATT&CK report -
-- This report shows information about ATT&CK techniques used by Infection Monkey. -
-
-
-
- -
- For questions, suggestions or any other feedback
- contact: labs@guardicore.com
- 
-
- );
- }
-
- generateInfoBadges(data_array) {
- return data_array.map(badge_data => {badge_data});
- }
-
- generateCrossSegmentIssue(crossSegmentIssue) {
- return labs@guardicore.com
- - {issuesDivArray}
{cmdText}
@@ -170,9 +172,9 @@ class RunMonkeyPageComponent extends AuthComponent {
static renderIconByState(state) {
if (state === 'running') {
- return 5. Zero Trust Report
-
- {content}
-
-
- );
- }
-
- generateReportContent() {
- let content;
-
- if (this.stillLoadingDataFromServer()) {
- content =
-
-
-
-
;
- }
-
- return (
-
- {
- print();
- }}/>
-
-
-
-
- {content} -
- - {content} -
- {
- print();
- }}/>
-
-
+
)
+ }
+
+ generateReportContent() {
+ return (
+
+
+
+
+
+
+ )
+ }
+
+ getTechniqueByTitle(title){
+ for (const tech_id in this.state.techniques){
+ if (! this.state.techniques.hasOwnProperty(tech_id)) {return false;}
+ let technique = this.state.techniques[tech_id];
+ if (technique.title === title){
+ technique['tech_id'] = tech_id;
+ return technique
+ }
+ }
+ return false;
+ }
+
+ static addLinksToTechniques(schema, techniques){
+ schema = schema.properties;
+ for(const type in schema){
+ if (! schema.hasOwnProperty(type)) {return false;}
+ let typeTechniques = schema[type].properties;
+ for(const tech_id in typeTechniques){
+ if (! typeTechniques.hasOwnProperty(tech_id)) {return false;}
+ if (typeTechniques[tech_id] !== undefined){
+ techniques[tech_id]['link'] = typeTechniques[tech_id].link
+ }
+ }
+ }
+ return techniques
+ }
+
+ render() {
+ let content = {};
+ if (typeof this.state.schema === 'undefined' || typeof this.state.techniques === 'undefined') {
+ content = + This report shows information about + + techniques used by Infection Monkey. +
+ {this.renderLegend()} ++
{this.generateReportContent()}
;
+ }
+ return (
+
+
+
+ {content} +
)
+ }
+}
+
+export default AttackReport;
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/SecurityReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/SecurityReport.js
new file mode 100644
index 000000000..b44f367e1
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/SecurityReport.js
@@ -0,0 +1,935 @@
+import React, {Fragment} from 'react';
+import BreachedServers from 'components/report-components/security/BreachedServers';
+import ScannedServers from 'components/report-components/security/ScannedServers';
+import PostBreach from 'components/report-components/security/PostBreach';
+import {ReactiveGraph} from 'components/reactive-graph/ReactiveGraph';
+import {edgeGroupToColor, options} from 'components/map/MapOptions';
+import StolenPasswords from 'components/report-components/security/StolenPasswords';
+import CollapsibleWellComponent from 'components/report-components/security/CollapsibleWell';
+import {Line} from 'rc-progress';
+import AuthComponent from '../AuthComponent';
+import PassTheHashMapPageComponent from '../pages/PassTheHashMapPage';
+import StrongUsers from 'components/report-components/security/StrongUsers';
+import ReportHeader, {ReportTypes} from './common/ReportHeader';
+import ReportLoader from './common/ReportLoader';
+import SecurityIssuesGlance from './common/SecurityIssuesGlance';
+import PrintReportButton from './common/PrintReportButton';
+
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { faMinus } from '@fortawesome/free-solid-svg-icons';
+
+let guardicoreLogoImage = require('../../images/guardicore-logo.png');
+
+
+class ReportPageComponent extends AuthComponent {
+
+ Issue =
+ {
+ WEAK_PASSWORD: 0,
+ STOLEN_CREDS: 1,
+ ELASTIC: 2,
+ SAMBACRY: 3,
+ SHELLSHOCK: 4,
+ CONFICKER: 5,
+ AZURE: 6,
+ STOLEN_SSH_KEYS: 7,
+ STRUTS2: 8,
+ WEBLOGIC: 9,
+ HADOOP: 10,
+ PTH_CRIT_SERVICES_ACCESS: 11,
+ MSSQL: 12,
+ VSFTPD: 13
+ };
+
+ Warning =
+ {
+ CROSS_SEGMENT: 0,
+ TUNNEL: 1,
+ SHARED_LOCAL_ADMIN: 2,
+ SHARED_PASSWORDS: 3,
+ SHARED_PASSWORDS_DOMAIN: 4
+ };
+
+ constructor(props) {
+ super(props);
+ this.state = {
+ report: props.report,
+ graph: {nodes: [], edges: []}
+ };
+ }
+
+ componentDidMount() {
+ this.updateMapFromServer();
+ }
+
+ componentWillUnmount() {
+ clearInterval(this.interval);
+ }
+
+ componentDidUpdate(prevProps) {
+ if (this.props.report !== prevProps.report) {
+ this.setState({ report: this.props.report })
+ }
+ }
+
+ render() {
+ let content;
+
+ if (this.stillLoadingDataFromServer()) {
+ content = + {content} +
+ {this.generateReportOverviewSection()}
+ {this.generateReportFindingsSection()}
+ {this.generateReportRecommendationsSection()}
+ {this.generateReportGlanceSection()}
+ {this.generateReportFooter()}
+
;
+ }
+
+ return (
+
+ {
+ print();
+ }}/>
+
+
+
+
+ {content} +
+ + {content} +
+ {
+ print();
+ }}/>
+
+
+ 0}/>
+ {
+ this.state.report.glance.exploited.length > 0 ?
+ ''
+ :
+
+ );
+ }
+
+ generateReportFindingsSection() {
+ return (
+ + Overview +
++ + To improve the monkey's detection rates, try adding users and passwords and enable the "Local + network + scan" config value under Basic - Network. +
+ } ++ The first monkey run was started on {this.state.report.overview.monkey_start_time}. After {this.state.report.overview.monkey_duration}, all monkeys finished + propagation attempts. +
++ The monkey started propagating from the following machines where it was manually installed: +
-
+ {this.state.report.overview.manual_monkeys.map(x =>
+ The monkeys were run with the following configuration: +
+ { + this.state.report.overview.config_users.length > 0 ? ++ Usernames used for brute-forcing: +
-
+ {this.state.report.overview.config_users.map(x =>
-
+ {this.state.report.overview.config_passwords.map(x =>
+ Brute forcing uses stolen credentials only. No credentials were supplied during Monkey’s + configuration. +
+ } + { + this.state.report.overview.config_exploits.length > 0 ? + ( + this.state.report.overview.config_exploits[0] === 'default' ? + '' + : ++ The Monkey uses the following exploit methods: +
-
+ {this.state.report.overview.config_exploits.map(x =>
+ No exploits are used by the Monkey. +
+ } + { + this.state.report.overview.config_ips.length > 0 ? ++ The Monkey scans the following IPs: +
-
+ {this.state.report.overview.config_ips.map(x =>
+ Note: Monkeys were configured to avoid scanning of the local network. +
+ } +
+
+ );
+ }
+
+ generateReportRecommendationsSection() {
+ return (
+ + Security Findings +
+
+
+ + Immediate Threats +
+ { + this.state.report.overview.issues.filter(function (x) { + return x === true; + }).length > 0 ? +
+ During this simulated attack the Monkey uncovered
+ {this.state.report.overview.issues.filter(function (x) {
+ return x === true;
+ }).length} threats:
+
+ :
+ -
+ {this.state.report.overview.issues[this.Issue.STOLEN_SSH_KEYS] ?
+
+ During this simulated attack the Monkey uncovered 0 threats.
+
+ }
+
+
+ {this.state.report.overview.cross_segment_issues.length > 0 ?
+ + Potential Security Issues +
+ { + this.state.report.overview.warnings.filter(function (x) { + return x === true; + }).length > 0 ? +
+ The Monkey uncovered the following possible set of issues:
+
+ :
+ -
+ {this.state.report.overview.warnings[this.Warning.CROSS_SEGMENT] ?
+
+ The Monkey did not find any issues.
+
+ }
+
+
+ :
+ ''
+ }
+ + Segmentation Issues +
+
+ The Monkey uncovered the following set of segmentation issues:
+
+ -
+ {this.state.report.overview.cross_segment_issues.map(x => this.generateCrossSegmentIssue(x))}
+
+ {/* Checks if there are any domain issues. If there are more then one: render the title. Otherwise,
+ * don't render it (since the issues themselves will be empty. */}
+ {Object.keys(this.state.report.recommendations.domain_issues).length !== 0 ?
+
+ );
+ }
+
+ generateReportGlanceSection() {
+ let exploitPercentage =
+ (100 * this.state.report.glance.exploited.length) / this.state.report.glance.scanned.length;
+ return (
+ Domain related recommendations
: null} +
+ {this.generateIssues(this.state.report.recommendations.domain_issues)}
+
+ {/* Checks if there are any issues. If there are more then one: render the title. Otherwise,
+ * don't render it (since the issues themselves will be empty. */}
+ {Object.keys(this.state.report.recommendations.issues).length !== 0 ?
+ Machine related recommendations
: null} +
+ {this.generateIssues(this.state.report.recommendations.issues)}
+
+
+
+ );
+ }
+
+ generateReportPthMap() {
+ return (
+ + The Network from the Monkey's Eyes +
+
+
+ + The Monkey discovered {this.state.report.glance.scanned.length} machines and + successfully breached {this.state.report.glance.exploited.length} of them. +
+
+
+ + From the attacker's point of view, the network looks like this: +
+
+ Legend:
+ Exploit
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {this.generateReportPthMap()}
+
+
+
+
+
+
+
+
+
+
+ );
+ }
+
+ generateReportFooter() {
+ return (
+ + Credentials Map +
++ This map visualizes possible attack paths through the network using credential compromise. Paths represent lateral + movement opportunities by attackers. +
+
+ Legend:
+ Access credentials
+
+
+
+ +
+ For questions, suggestions or any other feedback
+ contact: labs@guardicore.com
+
+
+ );
+ }
+
+ generateInfoBadges(data_array) {
+ return data_array.map(badge_data => {badge_data});
+ }
+
+ generateCrossSegmentIssue(crossSegmentIssue) {
+ return labs@guardicore.com
+ - {issuesDivArray}
+
+
+
+
;
+ }
+
+ return (
+
+ {
+ print();
+ }}/>
+
+
+
+
+ {content} +
+ + {content} +
+ {
+ print();
+ }}/>
+
+
+
);
+ }
+}
+
+export default ReportMatrixComponent;
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/attack/SelectedTechnique.js b/monkey/monkey_island/cc/ui/src/components/report-components/attack/SelectedTechnique.js
new file mode 100644
index 000000000..d46804975
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/attack/SelectedTechnique.js
@@ -0,0 +1,77 @@
+import React from 'react';
+import Collapse from '@kunukn/react-collapse';
+
+import AttackReport from '../AttackReport';
+import {FontAwesomeIcon} from '@fortawesome/react-fontawesome';
+import {faQuestionCircle} from '@fortawesome/free-solid-svg-icons';
+
+const classNames = require('classnames');
+
+class SelectedTechnique extends React.Component {
+
+ constructor(props) {
+ super(props);
+ this.state = {
+ techniques: this.props.techniques,
+ techComponents: this.props.techComponents,
+ selectedTechnique: this.props.selected
+ };
+ }
+
+ componentDidUpdate(prevProps) {
+ if (this.props.selected !== prevProps.selected || this.props.techniques !== prevProps.techniques) {
+ this.setState({ selectedTechnique: this.props.selected,
+ techniques: this.props.techniques})
+ }
+ }
+
+ getSelectedTechniqueComponent(tech_id) {
+ const TechniqueComponent = this.state.techComponents[tech_id];
+ return (
+
+
+
+
+
+ {
+ return (
+ );
+ }
+
+ render(){
+ let content = {};
+ let selectedTechId = this.state.selectedTechnique;
+ if(selectedTechId === false){
+ content = 'None. Select a technique from ATT&CK matrix above.';
+ } else {
+ content = this.getSelectedTechniqueComponent(selectedTechId)
+ }
+
+ return (
+
+
+
)
+ }}/>
+
+
+ {content}
+
+
+ )
+ }
+}
+
+export default SelectedTechnique;
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/attack/TechniqueDropdowns.js b/monkey/monkey_island/cc/ui/src/components/report-components/attack/TechniqueDropdowns.js
new file mode 100644
index 000000000..d22e8617a
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/attack/TechniqueDropdowns.js
@@ -0,0 +1,124 @@
+import React from 'react';
+import Collapse from '@kunukn/react-collapse';
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome'
+import { faQuestionCircle, faChevronUp, faChevronDown, faToggleOn } from '@fortawesome/free-solid-svg-icons'
+
+import {Button} from 'react-bootstrap';
+import AttackReport from '../AttackReport';
+
+const classNames = require('classnames');
+
+class TechniqueDropdowns extends React.Component{
+
+ constructor(props) {
+ super(props);
+ this.state = {
+ techniques: this.props.techniques,
+ techComponents: this.props.techComponents,
+ schema: this.props.schema,
+ collapseOpen: '',
+ techniquesHidden: true
+ };
+ }
+
+ componentDidUpdate(prevProps) {
+ if (this.props.techniques !== prevProps.techniques) {
+ this.setState({ techniques: this.props.techniques })
+ }
+ }
+
+ onToggle = technique =>
+ this.setState(state => ({collapseOpen: state.collapseOpen === technique ? null : technique}));
+
+ getTechniqueCollapse(tech_id) {
+ return (
+ Selected technique
+
+
+ {
+ this.setState({tech_id: collapseState});
+ }}
+ onInit={({collapseState}) => {
+ this.setState({tech_id: collapseState});
+ }}
+ render={collapseState => this.createTechniqueContent(collapseState, tech_id)}/>
+
+ );
+ }
+
+ createTechniqueContent(collapseState, technique) {
+ const TechniqueComponent = this.state.techComponents[technique];
+ return (
+
+
+
+ );
+ }
+
+ toggleTechList(){
+ this.setState({techniquesHidden: (! this.state.techniquesHidden)})
+ }
+
+ getOrderedTechniqueList(){
+ let content = [];
+ for(const type_key in this.state.schema.properties){
+ if (! this.state.schema.properties.hasOwnProperty(type_key)){
+ continue;
+ }
+ let tech_type = this.state.schema.properties[type_key];
+ content.push({tech_type.title}
); + for(const tech_id in this.state.techniques){ + if (! this.state.techniques.hasOwnProperty(tech_id)){ + continue; + } + let technique = this.state.techniques[tech_id]; + if(technique.type === tech_type.title){ + content.push(this.getTechniqueCollapse(tech_id)) + } + } + } + return content + } + + render(){ + let content = []; + let listClass = ''; + if (this.state.techniquesHidden){ + listClass = 'hidden-list' + } else { + content = this.getOrderedTechniqueList() + } + return ( +
+ {content}
+
);
+ }
+}
+
+export default TechniqueDropdowns;
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/common/ReportHeader.js b/monkey/monkey_island/cc/ui/src/components/report-components/common/ReportHeader.js
index 264109bfd..39efc0a01 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/common/ReportHeader.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/common/ReportHeader.js
@@ -7,6 +7,7 @@ let monkeyLogoImage = require('../../../images/monkey-icon.svg');
export const ReportTypes = {
zeroTrust: 'Zero Trust',
security: 'Security',
+ attack: 'ATT&CK',
null: ''
};
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/security/AttackReport.js b/monkey/monkey_island/cc/ui/src/components/report-components/security/AttackReport.js
deleted file mode 100644
index dfc3ff437..000000000
--- a/monkey/monkey_island/cc/ui/src/components/report-components/security/AttackReport.js
+++ /dev/null
@@ -1,199 +0,0 @@
-import React from 'react';
-import {Col} from 'react-bootstrap';
-import {ReactiveGraph} from 'components/reactive-graph/ReactiveGraph';
-import {edgeGroupToColor, options} from 'components/map/MapOptions';
-import '../../../styles/Collapse.scss';
-import AuthComponent from '../../AuthComponent';
-import {ScanStatus} from '../../attack/techniques/Helpers';
-import Collapse from '@kunukn/react-collapse';
-
-import T1210 from '../../attack/techniques/T1210';
-import T1197 from '../../attack/techniques/T1197';
-import T1110 from '../../attack/techniques/T1110';
-import T1075 from '../../attack/techniques/T1075';
-import T1003 from '../../attack/techniques/T1003';
-import T1059 from '../../attack/techniques/T1059';
-import T1086 from '../../attack/techniques/T1086';
-import T1082 from '../../attack/techniques/T1082';
-import T1145 from '../../attack/techniques/T1145';
-import T1105 from '../../attack/techniques/T1105';
-import T1107 from '../../attack/techniques/T1107';
-import T1065 from '../../attack/techniques/T1065';
-import T1035 from '../../attack/techniques/T1035';
-import T1129 from '../../attack/techniques/T1129';
-import T1106 from '../../attack/techniques/T1106';
-import T1188 from '../../attack/techniques/T1188';
-import T1090 from '../../attack/techniques/T1090';
-import T1041 from '../../attack/techniques/T1041';
-import T1222 from '../../attack/techniques/T1222';
-import T1005 from '../../attack/techniques/T1005';
-import T1018 from '../../attack/techniques/T1018';
-import T1016 from '../../attack/techniques/T1016';
-import T1021 from '../../attack/techniques/T1021';
-import T1064 from '../../attack/techniques/T1064';
-import {extractExecutionStatusFromServerResponse} from '../common/ExecutionStatus';
-
-const tech_components = {
- 'T1210': T1210,
- 'T1197': T1197,
- 'T1110': T1110,
- 'T1075': T1075,
- 'T1003': T1003,
- 'T1059': T1059,
- 'T1086': T1086,
- 'T1082': T1082,
- 'T1145': T1145,
- 'T1065': T1065,
- 'T1105': T1105,
- 'T1035': T1035,
- 'T1129': T1129,
- 'T1106': T1106,
- 'T1107': T1107,
- 'T1188': T1188,
- 'T1090': T1090,
- 'T1041': T1041,
- 'T1222': T1222,
- 'T1005': T1005,
- 'T1018': T1018,
- 'T1016': T1016,
- 'T1021': T1021,
- 'T1064': T1064
-};
-
-const classNames = require('classnames');
-
-class AttackReportPageComponent extends AuthComponent {
-
- constructor(props) {
- super(props);
- this.state = {
- report: false,
- allMonkeysAreDead: false,
- runStarted: true,
- collapseOpen: ''
- };
- }
-
- componentDidMount() {
- this.updateMonkeysRunning().then(res => this.getReportFromServer(res));
- }
-
- updateMonkeysRunning = () => {
- return this.authFetch('/api')
- .then(res => res.json())
- .then(res => {
- this.setState(extractExecutionStatusFromServerResponse(res));
- return res;
- });
- };
-
- getReportFromServer(res) {
- if (res['completed_steps']['run_monkey']) {
- this.authFetch('/api/attack/report')
- .then(res => res.json())
- .then(res => {
- this.setState({
- report: res
- });
- });
- }
- }
-
- onToggle = technique =>
- this.setState(state => ({collapseOpen: state.collapseOpen === technique ? null : technique}));
-
- getComponentClass(tech_id) {
- switch (this.state.report[tech_id].status) {
- case ScanStatus.SCANNED:
- return 'collapse-info';
- case ScanStatus.USED:
- return 'collapse-danger';
- default:
- return 'collapse-default';
- }
- }
-
- getTechniqueCollapse(tech_id) {
- return (
- + List of all techniques + +
+
-
- {
- this.setState({tech_id: collapseState});
- }}
- onInit={({collapseState}) => {
- this.setState({tech_id: collapseState});
- }}
- render={collapseState => this.createTechniqueContent(collapseState, tech_id)}/>
-
- );
- }
-
- createTechniqueContent(collapseState, technique) {
- const TechniqueComponent = tech_components[technique];
- return (
-
-
-
- );
- }
-
- renderLegend() {
- return (
-
)
- }
-
- generateReportContent() {
- let content = [];
- Object.keys(this.state.report).forEach((tech_id) => {
- content.push(this.getTechniqueCollapse(tech_id))
- });
- return (
-
- {this.renderLegend()}
- {content}
-
- )
- }
-
- render() {
- let content;
- if (!this.state.runStarted) {
- content =
- - - You have to run a monkey before generating a report! -
; - } else if (this.state.report === false) { - content = (Generating Report...
); - } else if (Object.keys(this.state.report).length === 0) { - if (this.state.runStarted) { - content = (No techniques were scanned
); - } - } else { - content = this.generateReportContent(); - } - return ( {content}
);
- }
-}
-
-export default AttackReportPageComponent;
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/EventsButton.js b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/EventsButton.js
index c8f68b12f..08c83babd 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/EventsButton.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/EventsButton.js
@@ -3,6 +3,9 @@ import EventsModal from './EventsModal';
import {Badge, Button} from 'react-bootstrap';
import * as PropTypes from 'prop-types';
+import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
+import { faList } from '@fortawesome/free-solid-svg-icons';
+
export default class EventsButton extends Component {
constructor(props) {
super(props);
@@ -25,7 +28,7 @@ export default class EventsButton extends Component {
exportFilename={this.props.exportFilename}/>
{this.props.pillar}
+ return
+ {this.props.pillar}
}
}
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/PrinciplesStatusTable.js b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/PrinciplesStatusTable.js
index a23b7e2be..6b1d22f6f 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/PrinciplesStatusTable.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/PrinciplesStatusTable.js
@@ -13,7 +13,7 @@ const columns = [
{
Header: 'Status', id: 'status',
accessor: x => {
- return Legend
+
-
- {text}
+ {text}
);
}
diff --git a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/SummarySection.js b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/SummarySection.js
index b6693ab59..3b2216956 100644
--- a/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/SummarySection.js
+++ b/monkey/monkey_island/cc/ui/src/components/report-components/zerotrust/SummarySection.js
@@ -1,6 +1,5 @@
import React, {Component} from 'react';
import {Col, Grid, Row} from 'react-bootstrap';
-import MonkeysStillAliveWarning from '../common/MonkeysStillAliveWarning';
import PillarsOverview from './PillarOverview';
import ZeroTrustReportLegend from './ReportLegend';
import * as PropTypes from 'prop-types';
@@ -12,7 +11,6 @@ export default class SummarySection extends Component {
Get a quick glance at how your network aligns with the @@ -22,11 +20,11 @@ export default class SummarySection extends Component {
-
-
-
+
+
)
}
diff --git a/monkey/monkey_island/cc/ui/src/styles/App.css b/monkey/monkey_island/cc/ui/src/styles/App.css
index 5003ae87e..91267b7a1 100644
--- a/monkey/monkey_island/cc/ui/src/styles/App.css
+++ b/monkey/monkey_island/cc/ui/src/styles/App.css
@@ -525,7 +525,6 @@ body {
.label-danger {
background-color: #d9534f !important;
}
-
}
/* Attack pages */
@@ -537,10 +536,6 @@ body {
margin-bottom: 20px;
}
-.attack-report .btn-collapse span:nth-of-type(2) {
- flex: 0;
-}
-
.icon-info {
color: #ade3eb !important;
}
@@ -588,8 +583,3 @@ body {
margin-right: auto;
}
-.attack-report.footer-text {
- text-align: right;
- font-size: 0.8em;
- margin-top: 20px;
-}
diff --git a/monkey/monkey_island/cc/ui/src/styles/Checkbox.scss b/monkey/monkey_island/cc/ui/src/styles/Checkbox.scss
index b18908c5e..149881edc 100644
--- a/monkey/monkey_island/cc/ui/src/styles/Checkbox.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/Checkbox.scss
@@ -12,6 +12,7 @@ $black: #000000;
text-align: center;
width: 100%;
height: 100%;
+ cursor: pointer;
input {
display: none;
@@ -39,6 +40,7 @@ $black: #000000;
background-color: $dark-green;
color: $light-grey;
fill: $light-grey;
+ cursor: default;
}
&.is-checked {
@@ -97,12 +99,47 @@ $black: #000000;
}
}
+.attack-matrix .ui-checkbox-btn label {
+ padding-top: 0;
+ position: relative;
+ float: left;
+ top: 50%;
+ left: 50%;
+ transform: translate(-50%, -50%);
+ padding-left: 5px;
+ padding-right: 5px;
+}
+
+.attack-matrix div.rt-td>div {
+ height: 100%;
+ padding: 0;
+}
+
+.attack-matrix div.rt-td {
+ padding: 0;
+ border-right: 3px solid rgba(0,0,0,0) !important;
+}
+
+.attack-matrix .rt-tr-group div.rt-td:first-child {
+ border-left: 3px solid rgba(0,0,0,0) !important;
+}
+
+
+.attack-matrix .rt-tr-group {
+ border-top: 3px solid white !important;
+ border-bottom: none !important;
+}
+
+.attack-matrix .rt-tr-group:last-child {
+ margin-bottom: 3px !important;
+}
+
.icon-checked {
color: $green
}
.icon-mandatory {
- color: $dark-green
+ color: $dark-green;
}
.icon-unchecked {
diff --git a/monkey/monkey_island/cc/ui/src/styles/Collapse.scss b/monkey/monkey_island/cc/ui/src/styles/Collapse.scss
index 9277400b8..30ebaf789 100644
--- a/monkey/monkey_island/cc/ui/src/styles/Collapse.scss
+++ b/monkey/monkey_island/cc/ui/src/styles/Collapse.scss
@@ -1,4 +1,4 @@
-$transition: 500ms cubic-bezier(0.4, 0.1, 0.1, 0.5);
+$transition: 300ms cubic-bezier(0.6, 0.3, 0.3, 0.6);
$danger-color: #d9acac;
$info-color: #ade3eb;
@@ -68,27 +68,12 @@ $default-color: #e0ddde;
overflow: hidden;
}
+.collapsing {
+ height:100% !important;
+}
+
.collapse-item .content {
padding: 2rem 0;
- transition: transform $transition;
- will-change: transform;
- $offset: 10px;
-
- &.collapsing {
- transform: translateY(-$offset);
- }
-
- &.collapse-comp {
- transform: translateY(-$offset);
- }
-
- &.expanding {
- transform: translateX(0px);
- }
-
- &.expanded {
- transform: translateX(0px);
- }
}
.collapse-item .text {
diff --git a/monkey/monkey_island/cc/ui/src/styles/report/AttackReport.scss b/monkey/monkey_island/cc/ui/src/styles/report/AttackReport.scss
new file mode 100644
index 000000000..60266de08
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/styles/report/AttackReport.scss
@@ -0,0 +1,82 @@
+.attack-report.footer-text {
+ text-align: right;
+ font-size: 0.8em;
+ margin-top: 20px;
+}
+
+.attack-report div.attack-legend {
+ margin-top: 30px;
+}
+
+.attack-report .hidden-list{
+ display: none;
+}
+
+.attack-technique-list-component .dropdown-list .btn-lg {
+ margin-top: 30px;
+ margin-bottom: 20px;
+ padding: 0;
+}
+
+.attack-report .link-to-technique {
+ margin-right: 10px;
+}
+
+.attack-report .selected-technique {
+ cursor: default;
+}
+
+.attack-report .padded{
+ padding: 2em 2em 0 2em;
+}
+
+.ReactTable .rt-td,.rt-resizable-header-content{
+ white-space: pre-line !important;
+ word-wrap: break-word;
+}
+
+.attack-link{
+ padding: 0 7px 3px 7px !important;
+}
+
+.attack-report .toggle-btn{
+ position:relative;
+ height:30px;
+ width:30px;
+}
+
+.attack-report .toggle-btn {
+ padding: 0;
+ margin-bottom: 30px;
+ margin-left: 6px;
+ outline: none !important;
+ font-size: 15px;
+}
+
+.attack-report .toggle-btn svg {
+ position:absolute;
+ left:0;
+ -webkit-transition: opacity 0.15s ease-in-out;
+ -moz-transition: opacity 0.15s ease-in-out;
+ -o-transition: opacity 0.15s ease-in-out;
+ transition: opacity 0.15s ease-in-out;
+}
+
+.attack-report .toggle-btn.toggled-on .switch-off{
+ opacity:0;
+}
+
+.attack-report .toggle-btn.toggled-off .switch-on{
+ opacity:0;
+}
+
+.attack-report .switch-off {
+ -webkit-transform: scaleX(-1);
+ transform: scaleX(-1);
+ color: gray;
+}
+
+.technique-status-icon {
+ padding-right:5px;
+ margin-bottom: 1px;
+}
diff --git a/monkey/monkey_island/cc/ui/src/styles/report/ReportAttackMatrix.scss b/monkey/monkey_island/cc/ui/src/styles/report/ReportAttackMatrix.scss
new file mode 100644
index 000000000..779db71dc
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/styles/report/ReportAttackMatrix.scss
@@ -0,0 +1,31 @@
+// colors
+$light-grey: #e0ddde;
+$light-blue: #ade3eb;
+$light-red: #d9acac;
+$black: #3a3a3a;
+
+.attack-matrix .status-0 {
+ background-color: $light-grey !important;
+ color: $black;
+}
+
+.attack-matrix .status-1 {
+ background-color: $light-blue !important;
+ color: $black;
+}
+
+.attack-matrix .status-2 {
+ background-color: $light-red !important;
+ color: $black;
+}
+
+.attack-matrix div.rt-td:hover {
+ transform: scale(1.08);
+ filter: brightness(110%);
+ z-index: 10000;
+}
+
+.attack-matrix .rt-thead,.-header {
+ border-bottom: 1px solid #0000000f;
+}
+
diff --git a/monkey/monkey_island/cc/ui/src/styles/report/ReportPage.scss b/monkey/monkey_island/cc/ui/src/styles/report/ReportPage.scss
new file mode 100644
index 000000000..36a3c005c
--- /dev/null
+++ b/monkey/monkey_island/cc/ui/src/styles/report/ReportPage.scss
@@ -0,0 +1,15 @@
+.report-nav {
+ margin-bottom: 2em !important;
+ position: sticky;
+ top: 0;
+ z-index: 1000000;
+ background-color: #ffffff;
+}
+
+.report-nav > li > a{
+ height: 50px !important;
+}
+
+.report-nav > li.active{
+ font-weight: bold;
+}