diff --git a/web/startScan/api/serializers.py b/web/startScan/api/serializers.py index e3dd14ba..2740b1e8 100644 --- a/web/startScan/api/serializers.py +++ b/web/startScan/api/serializers.py @@ -5,19 +5,41 @@ from reNgine.common_func import * from django.db.models import F, JSONField, Value -class VisualisePortSerializer(serializers.ModelSerializer): +class VisualiseVulnerabilitySerializer(serializers.ModelSerializer): description = serializers.SerializerMethodField('get_description') + class Meta: + model = Vulnerability + fields = [ + 'description', + 'http_url' + ] + + def get_description(self, vulnerability): + return vulnerability.name + + +class VisualisePortSerializer(serializers.ModelSerializer): + + description = serializers.SerializerMethodField('get_description') + title = serializers.SerializerMethodField('get_title') + class Meta: model = Port fields = [ - 'description' + 'description', + 'is_uncommon', + 'title', ] def get_description(self, port): return str(port.number) + "/" + port.service_name + def get_title(self, port): + if port.is_uncommon: + return "Uncommon Port" + class VisualiseTechnologySerializer(serializers.ModelSerializer): @@ -109,15 +131,91 @@ class VisualiseSubdomainSerializer(serializers.ModelSerializer): technologies = Technology.objects.filter(technologies__in=subdomain) tech_serializer = VisualiseTechnologySerializer(technologies, many=True) + vulnerability = Vulnerability.objects.filter( + scan_history=self.context.get('scan_history') + ).filter(subdomain=subdomain_name) + return_data = [] if ip_serializer.data: - return_data.append({'description': 'IPs', 'children': ip_serializer.data}) + return_data.append({ + 'description': 'IPs', + 'children': ip_serializer.data + }) if endpoint_serializer.data: - return_data.append({'description': 'Endpoints', 'children': endpoint_serializer.data}) + return_data.append({ + 'description': 'Endpoints', + 'children': endpoint_serializer.data + }) if tech_serializer.data: - return_data.append({'description': 'Technologies', 'children': tech_serializer.data}) + return_data.append({ + 'description': 'Technologies', + 'children': tech_serializer.data + }) + + if vulnerability: + vulnerability_data = [] + critical = vulnerability.filter(severity=4) + if critical: + critical_serializer = VisualiseVulnerabilitySerializer( + critical, + many=True + ) + vulnerability_data.append({ + 'description': 'Critical', + 'children': critical_serializer.data + }) + high = vulnerability.filter(severity=3) + if high: + high_serializer = VisualiseVulnerabilitySerializer( + high, + many=True + ) + vulnerability_data.append({ + 'description': 'High', + 'children': high_serializer.data + }) + medium = vulnerability.filter(severity=2) + if medium: + medium_serializer = VisualiseVulnerabilitySerializer( + medium, + many=True + ) + vulnerability_data.append({ + 'description': 'Medium', + 'children': medium_serializer.data + }) + low = vulnerability.filter(severity=1) + if low: + low_serializer = VisualiseVulnerabilitySerializer( + low, + many=True + ) + vulnerability_data.append({ + 'description': 'Low', + 'children': low_serializer.data + }) + info = vulnerability.filter(severity=0) + if info: + info_serializer = VisualiseVulnerabilitySerializer( + info, + many=True + ) + vulnerability_data.append({ + 'description': 'Informational', + 'children': info_serializer.data + }) + + if vulnerability_data: + return_data.append({ + 'description': 'Vulnerabilities', + 'children': vulnerability_data + }) + if subdomain_name.screenshot_path: - return_data.append({'description': 'Screenshot', 'screenshot_path': subdomain_name.screenshot_path}) + return_data.append({ + 'description': 'Screenshot', + 'screenshot_path': subdomain_name.screenshot_path + }) return return_data diff --git a/web/startScan/templates/startScan/detail_scan.html b/web/startScan/templates/startScan/detail_scan.html index d004ade0..86b5ca90 100644 --- a/web/startScan/templates/startScan/detail_scan.html +++ b/web/startScan/templates/startScan/detail_scan.html @@ -10,7 +10,6 @@ Detailed Scan - @@ -24,12 +23,12 @@ Detailed Scan - + {% endblock custom_js_css_link %} {% block breadcrumb_title %} @@ -716,6 +715,11 @@ Detailed Scan Results for {{history.domain.name}}
+
+ *Subdomains highlighted with green are 20X (OK) HTTP status + *Subdomains highlighted with orange are 30X (Redirect) HTTP status + *Subdomains highlighted with red are 40X (Not found) HTTP status +
diff --git a/web/static/assets/css/custom.css b/web/static/assets/css/custom.css index 536bde04..9b9ae97a 100644 --- a/web/static/assets/css/custom.css +++ b/web/static/assets/css/custom.css @@ -346,12 +346,6 @@ div.dataTables_wrapper div.dataTables_filter { background-color:#EEE; } -.node circle { - fill: #fff; - stroke: steelblue; - stroke-width: 1.5px; -} - .node text { font-size:10px; font-family:sans-serif; diff --git a/web/static/custom/mitch.js b/web/static/custom/mitch.js index 47993250..f9b7dfd8 100644 --- a/web/static/custom/mitch.js +++ b/web/static/custom/mitch.js @@ -54,6 +54,7 @@ function visualise_scan_results(scan_id) } updateTreeClasses(treePlugin); + }).fail(function(){ $('#visualisation-loader').empty(); $("#visualisation-loader").append(`
Sorry, could not visualize.
`); @@ -66,15 +67,24 @@ function visualise_scan_results(scan_id) bg_class = ''; var depthClass = "depth-" + data.depth; var existingClasses = this.getAttribute('class'); - if (data.data.http_status >= 400) { + if (data.data.http_status >= 400 || data.data.is_uncommon || data.data.description == 'High') { bg_class = " danger-box " } - else if (data.data.http_status > 200 && data.data.http_status < 400) { + else if (data.data.http_status > 200 && data.data.http_status < 400 || data.data.description == 'Medium') { bg_class = " warning-box " } else if (data.data.http_status == 200) { bg_class = " success-box " } + else if (data.data.description == 'Critical'){ + bg_class = " critical-box " + } + else if (data.data.description == 'Low'){ + bg_class = " low-box " + } + else if (data.data.description == 'Informational'){ + bg_class = " info-box " + } if (!existingClasses) return depthClass; var hasDepthClassAlready = (' ' + existingClasses + ' ').indexOf(' ' + depthClass + ' ') > -1; diff --git a/web/static/plugins/mitchtree/css/d3-mitch-tree-theme-default.css b/web/static/plugins/mitchtree/css/d3-mitch-tree-theme-default.css index 4b391063..a001c8f7 100644 --- a/web/static/plugins/mitchtree/css/d3-mitch-tree-theme-default.css +++ b/web/static/plugins/mitchtree/css/d3-mitch-tree-theme-default.css @@ -39,6 +39,21 @@ fill: #e7515a !important; } +.critical-box .body-group .body-box{ + stroke: #AA2C00 !important; + fill: #AA2C00 !important; +} + +.low-box .body-group .body-box{ + stroke: #FFD600 !important; + fill: #FFD600 !important; +} + +.info-box .body-group .body-box{ + stroke: #2196f3 !important; + fill: #2196f3 !important; +} + .success-box .body-group .body-box{ stroke: #1abc9c !important; fill: #1abc9c !important; @@ -50,7 +65,5 @@ } .title-group .d3plus-textBox text{ - font-size: 13px !important; - font-weight: 400 !important; - font-family: sans-serif !important; + font-size: 10px !important; }