DeforaNetworks/pentext
3
0
Fork 0
Code Releases Activity

Updated examplereport.xml so it’s valid again

Browse Source
This commit is contained in:
skyanth
2017-06-12 15:55:15 +02:00
parent 6ffdf28be0
commit 1918cdfac5
1 changed files with 137 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

231
xml/doc/examples/examplereport.xml
View File

@@ -1,10 +1,24 @@
<?xml version="1.0" encoding="UTF-8"?><pentest_report xmlns:xi="http://www.w3.org/2001/XInclude" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" findingCode="SID" xsi:noNamespaceSchemaLocation="../dtd/pentestreport.xsd"> <?xml version="1.0" encoding="UTF-8"?>
<pentest_report xmlns:xi="http://www.w3.org/2001/XInclude"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" findingCode="SID"
xsi:noNamespaceSchemaLocation="../dtd/pentestreport.xsd">
<meta> <meta>
<title>Penetration Test Report</title> <title>Penetration Test Report</title>
<xi:include href="client_info.xml"/>
<targets> <targets>
<target>fishinabarrel.sittingduck.com</target> <target>fishinabarrel.sittingduck.com</target>
</targets> </targets>
<activityinfo>
<duration>4</duration>
<persondays>4</persondays>
<test_planning>bla</test_planning>
<report_due>bla</report_due>
<nature>something</nature>
<type>black-box</type>
</activityinfo>
<permission_parties>
<xi:include href="client_info.xml"/>
</permission_parties>
<collaborators> <collaborators>
<reviewers> <reviewers>
<reviewer>Melanie Rieback</reviewer> <reviewer>Melanie Rieback</reviewer>
@@ -68,48 +82,50 @@ who is also the co-founder/CEO of Radically Open Security.</bio>
</version_history> </version_history>
<xi:include href="snippets/company_info.xml"/> <xi:include href="snippets/company_info.xml"/>
</meta> </meta>
<generate_index/> <generate_index/>
<section id="executiveSummary"> <section id="executiveSummary">
<title>Executive Summary</title> <title>Executive Summary</title>
<section id="introduction"> <section id="introduction">
<title>Introduction</title> <title>Introduction</title>
<p>Sitting Duck B.V. (“Sitting Duck”) has assigned <p>Sitting Duck B.V. (“Sitting Duck”) has assigned the task of performing a
the task of performing a Penetration Test of the FishInABarrel Web Penetration Test of the FishInABarrel Web Application to Radically
Application to Radically Open Security BV (hereafter “ROS”). Open Security BV (hereafter “ROS”). Sitting Duck has made this
Sitting Duck has made this request to better evaluate the security of the application and request to better evaluate the security of the application and to
to identify application level vulnerabilities in order to see whether the FishInABarrel identify application level vulnerabilities in order to see whether
Web Application is ready, security-wise, for production deployment.</p> the FishInABarrel Web Application is ready, security-wise, for
<p>This report contains our findings as well as detailed explanations of exactly how ROS performed production deployment.</p>
the penetration test.</p> <p>This report contains our findings as well as detailed explanations of
exactly how ROS performed the penetration test.</p>
</section> </section>
<section id="scope"> <section id="scope">
<title>Scope of work</title> <title>Scope of work</title>
<p>The scope of the Sitting Duck penetration test was limited to the following <p>The scope of the Sitting Duck penetration test was limited to the
target:</p> following target:</p>
<generate_targets/> <generate_targets/>
<p>The penetration test was carried out from a black box perspective: no information <p>The penetration test was carried out from a black box perspective: no
regarding the system(s) tested was provided by Sitting Duck or FishInABarrel, although FishInABarrel information regarding the system(s) tested was provided by Sitting
did provide ROS with two test user accounts.</p> Duck or FishInABarrel, although FishInABarrel did provide ROS with
two test user accounts.</p>
</section> </section>
<section id="objectives"> <section id="objectives">
<title>Project objectives</title> <title>Project objectives</title>
<p>The objective of the security assessment is to gain insight into the security of <p>The objective of the security assessment is to gain insight into the
the host and the FishInABarrel Web Application.</p> security of the host and the FishInABarrel Web Application.</p>
</section> </section>
<section id="timeline"> <section id="timeline">
<title>Timeline</title> <title>Timeline</title>
<p>The FishInABarrel Security Audit took place between January 14 and January 16, <p>The FishInABarrel Security Audit took place between January 14 and
2015.</p> January 16, 2015.</p>
</section> </section>
<section id="results"> <section id="results">
<title>Results in a Nutshell</title> <title>Results in a Nutshell</title>
<p>During this pentest, we found quite a number of different security problems – <p>During this pentest, we found quite a number of different security
Cross-site Scripting (XSS) vulnerabilities, both stored and reflected, Cross-site problems – Cross-site Scripting (XSS) vulnerabilities, both stored
Request Forgery (CSRF) vulnerabilities, and reflected, Cross-site Request Forgery (CSRF) vulnerabilities,
information disclosures (multiple instances), and lack of information disclosures (multiple instances), and lack of brute
brute force protection.</p> force protection.</p>
</section> </section>
<section id="findingSummary"> <section id="findingSummary">
<title>Summary of Findings</title> <title>Summary of Findings</title>
@@ -125,47 +141,59 @@ who is also the co-founder/CEO of Radically Open Security.</bio>
<title>Charts</title> <title>Charts</title>
<section id="threatlevelpie"> <section id="threatlevelpie">
<title>Findings by Threat Level</title> <title>Findings by Threat Level</title>
<generate_piechart pieAttr="threatLevel" pieElem="finding" pieHeight="200"/> <generate_piechart pieAttr="threatLevel" pieElem="finding"
pieHeight="200"/>
</section> </section>
<section id="typepie"> <section id="typepie">
<title>Findings by Type</title> <title>Findings by Type</title>
<generate_piechart pieAttr="type" pieElem="finding" pieHeight="200"/> <generate_piechart pieAttr="type" pieElem="finding" pieHeight="200"
/>
</section> </section>
<!-- generated from Findings section --> <!-- generated from Findings section -->
</section> </section>
</section> </section>
<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="snippets/report/methodology.xml"/> <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
href="snippets/report/methodology.xml"/>
<section id="recon"> <section id="recon">
<title>Reconnaissance and Fingerprinting</title> <title>Reconnaissance and Fingerprinting</title>
<p>Through automated scans we were able to gain the following information about the <p>Through automated scans we were able to gain the following information about the
software and infrastructure. Detailed scan output can be found in the sections software and infrastructure. Detailed scan output can be found in the
below.</p> sections below.</p>
<table border="1"><tr><th>Fingerprinted Information</th></tr> <table border="1">
<tr><td>Windows XP<br/>Microsoft IIS 6.0<br/>PHP 5.4.29<br/>jQuery 1.7.2<br/>Mailserver XYZ<br/>FTPserver ABC</td></tr></table> <tr>
<th>Fingerprinted Information</th>
</tr>
<tr>
<td>Windows XP<br/>Microsoft IIS 6.0<br/>PHP 5.4.29<br/>jQuery
1.7.2<br/>Mailserver XYZ<br/>FTPserver ABC</td>
</tr>
</table>
<section id="scans"> <section id="scans">
<title>Automated Scans</title> <title>Automated Scans</title>
<p>As part of our active reconnaissance we used the following automated scans:</p> <p>As part of our active reconnaissance we used the following automated
scans:</p>
<ul> <ul>
<li>nmap – <a href="http://nmap.org">http://nmap.org</a></li> <li>nmap – <a href="http://nmap.org">http://nmap.org</a></li>
<li>skipfish - <a href="https://code.google.com/p/skipfish/">https://code.google.com/p/skipfish/</a></li> <li>skipfish -
<a href="https://code.google.com/p/skipfish/">https://code.google.com/p/skipfish/</a></li>
<li>sqlmap – <a href="http://sqlmap.org">http://sqlmap.org</a></li> <li>sqlmap – <a href="http://sqlmap.org">http://sqlmap.org</a></li>
<li>Wapiti – <a href="http://wapiti.sourceforge.net">http://wapiti.sourceforge.net</a></li> <li>Wapiti –
<a href="http://wapiti.sourceforge.net">http://wapiti.sourceforge.net</a></li>
</ul> </ul>
<p>Of these, only the output of nmap turned out to be <p>Of these, only the output of nmap turned out to be useful; consequently
useful; consequently only nmap and output will be discussed in only nmap and output will be discussed in this section.</p>
this section.</p>
</section> </section>
<section id="nmap"> <section id="nmap">
<title>nmap</title> <title>nmap</title>
<p>Command:</p> <p>Command:</p>
<pre>$ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5 <pre>$ nmap -vvvv -oA fishinabarrel.sittingduck.com_complete -sV -sC -A -p1-65535 -T5
fishinabarrel.sittingduck.com</pre> fishinabarrel.sittingduck.com</pre>
<p>Outcome:</p> <p>Outcome:</p>
<pre> Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1) <pre> Nmap scan report for fishinabarrel.sittingduck.com (10.10.10.1)
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
@@ -194,57 +222,65 @@ PORT STATE SERVICE
Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)</pre> Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)</pre>
<p>The scan revealed a very large number of open services on this machine, which <p>The scan revealed a very large number of open services on this machine,
greatly increases the attack surface; see <a href="#f2"/> for more information on the which greatly increases the attack surface; see <a href="#f2"/> for
security risk.</p> more information on the security risk.</p>
</section> </section>
</section> </section>
<section id="techSummary"> <section id="techSummary">
<title>Pentest Technical Summary</title> <title>Pentest Technical Summary</title>
<section id="findings"> <section id="findings">
<title>Findings</title> <title>Findings</title>
<p>We have identified the following issues:</p> <p>We have identified the following issues:</p>
<finding id="f1" threatLevel="Moderate" type="Information Leak"> <finding id="f1" threatLevel="Moderate" type="Information Leak">
<title>PHPInfo Disclosure</title> <title>PHPInfo Disclosure</title>
<description> <description>
<p>The phpinfo() function of the PHP language is readable, <p>The phpinfo() function of the PHP language is readable,
resulting in a listing of all the runtime information of the environment, resulting in a listing of all the runtime
thus disclosing potentially valuable information to attackers.</p> information of the environment, thus disclosing
potentially valuable information to attackers.</p>
</description> </description>
<technicaldescription> <technicaldescription>
<p>This is where the good stuff goes. We give a detailed technical description of the problem.</p> <p>This is where the good stuff goes. We give a detailed
<p>Illustrative picture of an evil hacker pondering dark deeds:</p> technical description of the problem.</p>
<p>Illustrative picture of an evil hacker pondering dark
deeds:</p>
<img height="10" src="../graphics/screenshot.jpg"/> <img height="10" src="../graphics/screenshot.jpg"/>
</technicaldescription> </technicaldescription>
<impact> <impact>
<p>This is where we explain how the sh*t is hitting the fan, exactly.</p> <p>This is where we explain how the sh*t is hitting the fan,
exactly.</p>
</impact> </impact>
<recommendation> <recommendation>
<p>Here is where we write some tips to solve the problem.</p> <p>Here is where we write some tips to solve the
problem.</p>
</recommendation> </recommendation>
</finding> </finding>
<finding id="f2" threatLevel="High" type="XSS"> <finding id="f2" threatLevel="High" type="XSS">
<title>A terrible XSS issue</title> <title>A terrible XSS issue</title>
<description> <description>
<p>A general description of the problem.</p> <p>A general description of the problem.</p>
</description> </description>
<technicaldescription> <technicaldescription>
<p>This is we go into great detail about the vulnerability.</p> <p>This is we go into great detail about the
vulnerability.</p>
</technicaldescription> </technicaldescription>
<impact> <impact>
<p>This is where we explain why this vulnerability is a problem.</p> <p>This is where we explain why this vulnerability is a
problem.</p>
</impact> </impact>
<recommendation> <recommendation>
<p>This is where we solve everything and the sun starts shining again.</p> <p>This is where we solve everything and the sun starts
shining again.</p>
</recommendation> </recommendation>
</finding> </finding>
<finding id="f3" threatLevel="Low" type="XSS"> <finding id="f3" threatLevel="Low" type="XSS">
<title>A not quite so terrible XSS issue</title> <title>A not quite so terrible XSS issue</title>
<description> <description>
@@ -261,23 +297,24 @@ Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)</pre>
</recommendation> </recommendation>
</finding> </finding>
</section> </section>
<section id="nonFindings"> <section id="nonFindings">
<title>Non-Findings</title> <title>Non-Findings</title>
<p>In this section we list some of the things that were tried but turned out to be <p>In this section we list some of the things that were tried but turned out
dead ends.</p> to be dead ends.</p>
<non-finding id="ftp"> <non-finding id="ftp">
<title>FTP</title> <title>FTP</title>
<p>The server was running FTPserver ABC, the most recent <p>The server was running FTPserver ABC, the most recent version of
version of this particular piece of software. Anonymous login was turned off and no this particular piece of software. Anonymous login was
relevant vulnerabilities or exploits were found.</p> turned off and no relevant vulnerabilities or exploits were
found.</p>
</non-finding> </non-finding>
<non-finding id="mail"> <non-finding id="mail">
<title>Mail Server</title> <title>Mail Server</title>
<p>The server was running Mailserver XYZ, the most recent <p>The server was running Mailserver XYZ, the most recent version of
version of this particular piece of software. No relevant vulnerabilities or this particular piece of software. No relevant
exploits were found. </p> vulnerabilities or exploits were found. </p>
</non-finding> </non-finding>
<non-finding id="sqlInjection"> <non-finding id="sqlInjection">
<title>SQL Code Injection</title> <title>SQL Code Injection</title>
@@ -286,37 +323,43 @@ Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)</pre>
<pre>-file1.php <pre>-file1.php
-file2.php -file2.php
-file3.php -file3.php
</pre></non-finding> </pre>
</non-finding>
<non-finding id="heartbleed"> <non-finding id="heartbleed">
<title>Heartbleed</title> <title>Heartbleed</title>
<p>System was not vulnerable to heartbleed.</p> </non-finding> <p>System was not vulnerable to heartbleed.</p>
</non-finding>
<non-finding id="sp2"> <non-finding id="sp2">
<title>Windows XP</title> <title>Windows XP</title>
<p>The host is running Windows XP. As we all know, Windows XP is bulletproof.</p> <p>The host is running Windows XP. As we all know, Windows XP is
bulletproof.</p>
</non-finding> </non-finding>
</section> </section>
</section> </section>
<section id="conclusion"> <section id="conclusion">
<title>Conclusion</title> <title>Conclusion</title>
<p>In the course of this penetration test, we have demonstrated that the FishInABarrel <p>In the course of this penetration test, we have demonstrated that the
Web Application faces a range of security issues which makes it vulnerable to a number FishInABarrel Web Application faces a range of security issues which makes
of different attacks. Vulnerabilities found included: cross-site scripting (both stored it vulnerable to a number of different attacks. Vulnerabilities found
and reflected), cross-site request forgery, information disclosure included: cross-site scripting (both stored and reflected), cross-site
and lack of brute force protection.</p> request forgery, information disclosure and lack of brute force
<p>Our conclusion is that there are a number of things that FishInABarrel BV has to fix before protection.</p>
Sitting Duck should use their software. A number of the security issues highlighted in this <p>Our conclusion is that there are a number of things that FishInABarrel BV has to
report have fairly simple solutions, but these should nevertheless be fixed before use fix before Sitting Duck should use their software. A number of the security
of the FishInABarrel Web App continues.</p> issues highlighted in this report have fairly simple solutions, but these
<p>We finally want to emphasize that security is a process – and this penetration test is should nevertheless be fixed before use of the FishInABarrel Web App
just a one-time snapshot. Security posture must be continuously evaluated and improved. continues.</p>
Regular audits and ongoing improvements are essential in order to maintain control of <p>We finally want to emphasize that security is a process – and this penetration
your corporate information security. We hope that this pentest report (and the detailed test is just a one-time snapshot. Security posture must be continuously
explanations of our findings) will contribute meaningfully towards that end. Don't evaluated and improved. Regular audits and ongoing improvements are
hesitate to let us know if you have any further questions or need further clarification essential in order to maintain control of your corporate information
of anything in this report.</p> security. We hope that this pentest report (and the detailed explanations of
our findings) will contribute meaningfully towards that end. Don't hesitate
to let us know if you have any further questions or need further
clarification of anything in this report.</p>
</section> </section>
<appendix id="testteam"> <appendix id="testteam">
<title>Testing team</title> <title>Testing team</title>
<generate_testteam/> <generate_testteam/>
</appendix> </appendix>
</pentest_report> </pentest_report>