talsoft / vuldash

Vulnerability Dashboard

vuldash (Vulnerability Dashboard)

Vuldash allows managing projects ethical hacking together with the group of pentester and the client, showing the problems concisely. Can generate business and technical reports, as also perform a life cycle of the project with the client.

DEMO VIDEO

https://www.youtube.com/watch?v=2R503Grq_HE

Custom Plugins

• You can create your own plugin for your tools and import the data into the platform.

Reporting

• You can generate professional reports with the format of your templates. (en,es)

Customer Features

• Allows your customers to perform
• Tracking and export of reported incidents.
• Online access of incidents at managerial and technical

Security Company Features

• Allows your administrators and pentester users to perform.
• Creating users for customer projects and pentester users.
• Tracking in different states of the incidents found in an ethical hacking project.

Authors

• Andrés Gaggini @AndresGaggini
• Leandro Ferrari @avatar_leandro www.talsoft.com.ar

Colaborators

• Cristian Maureira @subredes

Requirements

• Apache php 5.6 (modules php5.6-gd php5.6-json php5.6-mbstring php5.6-xsl php5.6-zip)
• Mysql 5.5

Recommendations

• Use filter allow from ip origin at .htaccess
• Install certificadte SSL to use the system, (eg. https://letsencrypt.org)

Initial Setup

• Create directory vuldash and clone vuldash
  1. mkdir /var/www/vuldash
  2. cd /var/www/vuldash
  3. git clone https://github.com/talsoft/vuldash.git dashboard
• Apache VirtualHost Minimal setup
  1. nano /etc/apache2/sites-enabled/000-default.conf
• Into VirtualHost Change
  1. DocumentRoot --> /var/www/vuldash
  2. Directory --> <Directory /var/www/vuldash>
• Apache settings
  1. a2enmod rewrite
  2. services apache2 restart

Database

• Edit file application/config/database.php to change credentials conection.
  1. nano dashboard/application/config/database.php
• Create database and user vuldash
• Import vuldashdb.sql into mysql database

Application setup

• Edit file application/config/app.php to change setting application.
• Change config of server mail account to send notificacion of activation accounts.
• Change values google_site_key and google_secret_key to use Captha Google.

Usage

• Access vuldash (eg: http://localhost/dashboard)
• First login with user: [email protected] pass: admin
• Add users of vuldash with roles administrator and tester.
• Add the system tables of type of incidents state, project type, project state, incidents type and objetive state.
• Add clients and users clients.
• Assign a project to a client.

From projects

• Import XML nmap results

From Incident

• Import XML Zap proxy Alerts
• Import XML Openvas report (coming soon)

Templates Reports

• You can change report template into directory vuldash/assets/odt-templates/
• Add _en or _sp at the end of the name from choose that languages

Tips

• You have error in generate report or incidents?
  1. Check folder "tmp" in the site root and set permission for write.
  2. Check the report language in the proyect properties with the name of report template

vuldash's Issues

Possible SQL injection

This http://vuldashIP/dashboard/projectsstate/save?id=%27&name=%27, if it is attacked by a tool like sqlmap, can create a lot of empty fields inside the database and create a performance issue for the app. Also, Sqlmap can create requests to that URL without authentication in the first place. A simple test with the tool creates this
| 30343 | |
| 30344 | |
| 30345 | |
| 30346 | |
| 30347 | |
| 30348 | |
| 30349 | |
+-------+-----------+
30348 rows in set (0,01 sec)

mysql>

Please see if you can reproduce the problem with,
sqlmap -u "http://vuldashIP/dashboard/projectsstate/save?id=*&name=*" -b --level=5 --risk=3 --dbms=mysql

Also the function edit, delete, getlist are not protected in projectsstate.php in the application/controllers.
index function is well protected by redirecting user to the login page.

problem when installing vuldash

When I go to the link localhost/vuldash/dashboard/ I receive a 404 error with the login.
How can I fix that error? What was my mistake?

Dockerfile

Is there a docker version of vuldash, so it will be easy to try and deploy?

Still alive

Hello, ist this project still alive?

Kind regards

Is this project stalled?

Is this project not being maintained anymore? There hasn't been any activity in awhile.

The upload destination folder does not appear to be writable.

Hello, which is the destination folder?

kind regards

more visibility

On github you can look for project by tags (named topics on github). Example: https://github.com/topics/pentest

For a better visibility you can add tags, like:

• pentest
• pentest-dashboard
• vulnerability
• vulnerability-dashboard
• dashboard
• cybersecurity
• infosec
• etc.

https://help.github.com/en/articles/classifying-your-repository-with-topics

Inventory notification

Your tool/software has been inventoried on Rawsec's CyberSecurity Inventory.

https://inventory.rawsec.ml/tools.html#vuldash

What is Rawsec's CyberSecurity Inventory?

An inventory of tools and resources about CyberSecurity. This inventory aims to help people to find everything related to CyberSecurity.

• Open source: Every information is available and up to date. If an information is missing or deprecated, you are invited to (help us).
• Practical: Content is categorized and table formatted, allowing to search, browse, sort and filter.
• Fast: Using static and client side technologies resulting in fast browsing.
• Rich tables: search, sort, browse, filter, clear
• Fancy informational popups
• Badges / Shields
• Static API
• Twitter bot

More details about features here.

Note: the inventory is a FLOSS (Free, Libre and Open-Source Software) project.

Why?

• Specialized websites: Some websites are referencing tools but additional information is not available or browsable. Make additional searches take time.
• Curated lists: Curated lists are not very exhaustive, up to date or browsable and are very topic related.
• Search engines: Search engines sometimes does find nothing, some tools or resources are too unknown or non-referenced. These is where crowdsourcing is better than robots.

Why should you care about being inventoried?

Mainly because this is giving visibility to your tool, more and more people are using the Rawsec's CyberSecurity Inventory, this helps them find what they need.

Badges

The badge shows to your community that your are inventoried. This also shows you care about your project and want it growing, that your tool is not an abandonware.

Feel free to claim your badge here: http://inventory.rawsec.ml/features.html#badges, it looks like that , but there are several styles available.

Want to thank us?

If you want to thank us, you can help make the project better known by tweeting about it! For example:

So what?

That's all, this message is just to notify you if you care.