From 5e2e137e28849f3ae809425ce648bbc19a296cb7 Mon Sep 17 00:00:00 2001
From: Yogesh Ojha <yogesh.ojha11@gmail.com>
Date: Mon, 28 Aug 2023 11:24:40 +0530
Subject: [PATCH] fix gpt attack suggestion

---
 web/api/views.py                                   |  1 +
 web/reNgine/definitions.py                         | 10 ++++++----
 web/reNgine/gpt.py                                 | 10 +++++++---
 web/startScan/templates/startScan/detail_scan.html |  1 +
 web/static/custom/custom.js                        |  3 +--
 5 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/web/api/views.py b/web/api/views.py
index af2fd35f..89ad49a7 100644
--- a/web/api/views.py
+++ b/web/api/views.py
@@ -72,6 +72,7 @@ class GPTAttackSuggestion(APIView):
 			Technologies Used: {tech_used}
 			Content type: {subdomain.content_type}
 			Web Server: {subdomain.webserver}
+			Page Content Length: {subdomain.content_length}
 		'''
 		gpt = GPTAttackSuggestionGenerator()
 		response = gpt.get_attack_suggestion(input)
diff --git a/web/reNgine/definitions.py b/web/reNgine/definitions.py
index 5faa974f..7d481892 100644
--- a/web/reNgine/definitions.py
+++ b/web/reNgine/definitions.py
@@ -451,7 +451,8 @@ VULNERABILITY_DESCRIPTION_SYSTEM_MESSAGE = """
 
 ATTACK_SUGGESTION_GPT_SYSTEM_PROMPT = """
     You are a highly skilled penetration tester who has recently completed a reconnaissance on a target.
-    You will be given with a
+    As a penetration tester, I've conducted a thorough reconnaissance on a specific subdomain.
+    Based on my reconnaissance you will be given with a
         - Subdomain Name
         - Subdomain Page Title
         - Open Ports if any detected
@@ -459,7 +460,8 @@ ATTACK_SUGGESTION_GPT_SYSTEM_PROMPT = """
         - Technologies Detected
         - Content Type
         - Web Server
-
-    Your job is to generate the attack surface, explore potential attack vectors and find possible attacks on the given subdomain.
-    You must give atlest one logical reason why you think the attack is likely to happen.
+        - Page Content Length
+    I'm seeking insights into potential technical web application attacks that could be executed on this subdomain, along with explanations for why these attacks are feasible given the discovered information.
+    Please provide a detailed list of these attack types and their underlying technical rationales on every attacks you suggested.
+    Also suggest if any CVE ID, known exploits, existing vulnerabilities, any news articles URL related to the information provided to you.
 """
diff --git a/web/reNgine/gpt.py b/web/reNgine/gpt.py
index c1268077..4bae2563 100644
--- a/web/reNgine/gpt.py
+++ b/web/reNgine/gpt.py
@@ -89,9 +89,11 @@ class GPTAttackSuggestionGenerator:
 		if not self.api_key:
 			return {
 				'status': False,
-				'error': 'No OpenAI keys provided.'
+				'error': 'No OpenAI keys provided.',
+				'input': input
 			}
 		openai.api_key = self.api_key
+		print(input)
 		try:
 			gpt_response = openai.ChatCompletion.create(
 			model=self.model_name,
@@ -103,10 +105,12 @@ class GPTAttackSuggestionGenerator:
 			response_content = gpt_response['choices'][0]['message']['content']
 			return {
 				'status': True,
-				'description': response_content
+				'description': response_content,
+				'input': input
 			}
 		except Exception as e:
 			return {
 				'status': False,
-				'error': str(e)
+				'error': str(e),
+				'input': input
 			}
diff --git a/web/startScan/templates/startScan/detail_scan.html b/web/startScan/templates/startScan/detail_scan.html
index ab2ad9ca..d9e46ef4 100644
--- a/web/startScan/templates/startScan/detail_scan.html
+++ b/web/startScan/templates/startScan/detail_scan.html
@@ -2282,6 +2282,7 @@ $(document).ready(function() {
 							const cms_detector_http_url = row['http_url'] ? row['http_url'] : 'https://' + row['name'];
 							return `
 							<div class="btn-group mt-2">
+							<button type="button" data-toggle="tooltip" data-placement="top" title="Show Attack Surface" class="btn btn-primary me-1 bs-tooltip" onclick="show_attack_surface_modal(${row['id']})"><i class="fe-eye"></i></button>
 							<button type="button" data-toggle="tooltip" data-placement="top" title="Further Scan Subdomain" class="btn btn-primary btn-scan-subdomain me-1" id="${row['id']}"><i class="fe-zap"></i></button>
 							<button type="button" data-toggle="tooltip" data-placement="top" title="Add Recon Todo/Note" class="btn btn-primary me-1" id="${row['id']}" onclick="add_note_for_subdomain(${row['id']}, '${row['name']}')"><i class="fe-file-plus"></i></button>
 							<button class="btn btn-primary me-1 dropdown-toggle" data-bs-toggle="dropdown" aria-expanded="false"><i class="mdi mdi-dots-horizontal"></i></button>
diff --git a/web/static/custom/custom.js b/web/static/custom/custom.js
index c7e2f11b..ae8ff7f1 100644
--- a/web/static/custom/custom.js
+++ b/web/static/custom/custom.js
@@ -3250,9 +3250,8 @@ async function show_attack_surface_modal(id){
 		showSwalLoader(loader_title, text);
 		const data = await send_gpt__attack_surface_api_request(id);
 		Swal.close();
-		console.log(data);
 		if (data.status) {
-			$('#modal_title').html(`Attack Surface Suggestion for ${data.subdomain_name}`);
+			$('#modal_title').html(`Attack Surface Suggestion for ${data.subdomain_name} (BETA)`);
 			$('#modal-content').empty();
 			$('#modal-content').append(data.description.replace(new RegExp('\r?\n','g'), '<br />'));
 			$('#modal_dialog').modal('show');