![]() You can run the main process as a non root user and have it sudo the nmap and masscan processes for no security benefits of course. Also note that for nmap and masscan to run, the server process should most conveniently run as root. As most scan jobs are shell commands constructed from unvalidated user input, anyone having access to the GUI can insta-pwn the whole box this runs on in no time. Currently it doesn't validate user input in any way (feel free to contribute with PRs fixing this). Some people I know suggested I use the Vue + vuex + tailwind tech stack for the GUI and I think it turned out well.ĪSSCAN by itself has absolutely no security measures built in. I've never created a web frontend for anything so I was picking up javascript and shit up as I went. The web UI is a Vue single page application. Interpreting scan results is either by reading xml files (masscan, nmap) or just parsing textual output of scan tools / scripts. Scan jobs are run as shell scripts or commands. The server part is written in Python3 on top of the tornadoweb framework. It has a REST API to submit scan jobs and query results, either all of them or filtered by some criteria, including network prefix, discovered open ports, or discovered vulnerabilities. OverviewĪSSCAN is a glorified adhoc script running platform. I decided to publish this smelling pile in hope of it being useful to neighboring hackers and to welcome contributions. A lot is missing in terms of functionality and code quality, like input validation (there's none), runtime optimization, result filtering, etc. The current state of the codebase is that enough features have been implemented for ASSCAN to be useful in some environments but otherwise it's really far from being finished and stable in any way. Commercial tools exist but they cost a lot and can't be easily enhanced to run arbitrary custom scanners so I decided to roll my own. Even with all the scripting, going through the results manually was time consuming at best. ![]() ![]() ![]() I tried scripting everything, first doing initial scans with masscan to even find what we got, then nmapping for more details on everything, then lots of adhockery to find specific vulns and and finally screenshot most services that could be screenshot (rdp, vnc, web). That was a basic recon / vuln finding exercise. Recently, I did a network wide survey of our office infrastructure at work, on a /8 network with thousands of hosts. It probably makes more sense to run this on a container than dedicate a VM for it. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. Archives
December 2022
Categories |