Package: autoauditor
DescriptionSemiautomatic vulnerabilities auditor using docker containers.Resources scripts examples:tools/vulnerable_net/examples/rc.example*.jsonDockerfiles used in vulnerable network:third_party/vulhubVulnerable network docker compose:tools/vulnerable_net/docker-compose.yamlFabric network docker compose:tools/fabric_net/docker-compose*.yamlContents:RequirementsPre-execution (optional)Vulnerable networkFabric networkGroupsigPython virtual environmentExecutionCommand line interfaceNormal executionStoreWizardStopQueryGraphical user interfaceNormal executionStoreWizardStopOutputPost-execution (optional)Vulnerable networkFabric networkGroupsigPython virtual environmentErrors and fixesInvalid credentialsFile or directory not foundDNS resolution failedFailed to connectMultiple definitions (libgroupsig)AcknowledgementsLicenseRequirementsdockerdocker-compose-plugingitgopython3-devpython3-venvTested on Ubuntu +20.04 and Debian 11If groupsig is required:build-essentialcmakelibssl-devPatched libraries can be found inthird_party, required for specific modules:Hyperledger Fabric:fabric_sdk_pyWizard:pymetasploit3libgroupsig: must be compiled according to instructions inlibgroupsigSetup scripts can be found intools.Note: If you installed autoauditor via pip, please check the homepage to
downloadthird_partyandtoolsfolders.Pre-execution (optional)Vulnerable networkWe have prepared a containerized environment with vulnerable machines: vulnerable_netFeatures:Isolated network: autoauditor_vulnerable_netTen vulnerable containers + VPN server containerautoauditor_vpn_serverautoauditor_coldfusion_10_2861autoauditor_http_14_6271autoauditor_struts2_16_3081autoauditor_struts2_17_5638autoauditor_weblogic_17_10271autoauditor_supervisor_17_11610autoauditor_goahead_17_17562autoauditor_ssh_18_10933autoauditor_ssh_18_15473autoauditor_rails_19_5418VPN server to allow external access: autoauditor_vpn_serverRun:tools/vulnerable_net.shNote:If groupsig will be used, launch the above command with
parameter--with-groupsigin order to compile the dependencies$tools/vulnerable_net.sh--with-groupsigFabric networkWe have prepared a containerized environment mimicking hyperledger
fabric network: fabric_netFeatures:Isolated network: autoauditor_fabric_netTwelve containers + DNS containerautoauditor_dnsautoauditor_ca_ordererautoauditor_ordererautoauditor_ca_org1autoauditor_peer0_org1autoauditor_couchdb_org1autoauditor_ca_org2autoauditor_peer0_org2autoauditor_couchdb_org2autoauditor_ca_org3autoauditor_peer0_org3autoauditor_couchdb_org3autoauditor_cliFour organizations:Org1: Peer + CAUsers: admin, user1, user2Org2: Peer + CAUsers: admin, user1, user2Org3: Peer + CAUsers: admin, user1, user2Orderer: Orderer + CAUsers: adminReport smart contract installed in Org1Whistleblower smart contract installed in Org1 and Org3One DNS resolver.Run:$tools/fabric_net.sh--fillGroupsigIn order to use groupsig add-on, it is mandatory to compile
the C sources:$cdthird_party/libgroupsig/libgroupsig
$mkdirbuild
$cdbuild
$cmake..
$makeAnd generate the crypto material for each component (must be run
after fabric_net is up):$tools/groupsig.shStart the provider and verifier servers:$pythontools/groupsig/provider/groupsig_provider.py--crttools/groupsig/provider/provider.crt--keytools/groupsig/provider/provider.key--ca-dirtools/groupsig/provider/fabric_ca_certs$pythontools/groupsig/verifier/groupsig_verifier.py--crttools/groupsig/verifier/verifier.crt--keytools/groupsig/verifier/verifier.key-btools/groupsig/examples/network.example.jsonTools to register members in the group, publish disclosures and read disclosures
can be found undertools/groupsig/informerandtools/groupsig/recipient.Register:$pythontools/groupsig/informer/groupsig_register.py-utools/groupsig/informer/fabric_credentials--crtuser.crt--keyuser.key-dtools/groupsig/informer/credentialsPublish disclosure:$pythontools/groupsig/informer/groupsig_inform.py-utools/groupsig/informer/fabric_credentials--crtuser.crt--keyuser.key-dtools/groupsig/informer/credentialsRead disclosures:$pythontools/groupsig/recipient/groupsig_read.py-utools/groupsig/recipient/fabric_credentials--crtuser.crt--keyuser.keyPython virtual environmentIn order to enable the virtual environment generated in previous steps, run:$source.venv/bin/activateOr install requirements manually:$pipinstall-rrequirements.txtExecutionThe account that runs autoauditor must be part ofdockergroup
in order to access docker API without sudo.Command line interfaceList of commands and parameters$python-mautoauditor--help
$python-mautoauditor.query--helpNormal execution$python-mautoauditor--cli-rtools/vulnerable_net/examples/rc.example5v.json-vtools/vulnerable_net/examples/vpn.example.ovpn-btools/vulnerable_net/examples/network.example.json--cli: Run autoauditor (command line interface).-r: Path to the resources script.-v: Path to the VPN configuration.-b: Path to the HLF configuration.Store$python-mautoauditor--store-btools/vulnerable_net/examples/network.example.json--store: Store reports in blockchain without running autoauditor.-b: Path to the HLF configuration.Wizard$python-mautoauditor--wizard-rmyrc.json--wizard: Run resources script creation tool.-r: Output path of resources script.Stop$python-mautoauditor--stopQuery$python-mautoauditor.query--querydate-qd2020-12-btools/vulnerable_net/examples/network.example.json--query: Type of query. Query by date.-qd: Filtering date.-b: Path to the HLF configuration.Graphical user interface$python-mautoauditor--guiScreenshotsMain windowAboutLicenseMenubarWindows menuSettings menuOption informationConsole outputNormal executionScreenshotsExecutingStoreScreenshotsStoring reportsWizardScreenshotsOpening wizardWizard windowModule informationModule optionsModule option informationModule option errorPayload informationStopScreenshotsStopping containersOutputautoauditor log:output/msf.log.autoauditor loot directory:output.autoauditor blockchain log:output/blockchain.log.Output files can be changed with:-of,-odand-obarguments.Stored reports identified by ID(sha256(orgName+reportDate)).Post-execution (optional)Vulnerable networkStop vulnerable network$tools/vulnerable_net.sh--downFabric networkStop fabric network$tools/fabric_net.sh--downGroupsigRemove crypto material$tools/groupsig.sh--cleanPython virtual environmentDeactivate virtual environment$deactivateErrors and fixesInvalid credentialsMissing 'proposalResponses' parameter in transaction request.status = StatusCode.UNKNOWNdetails = "error validating proposal: access denied: channel [channel1] creator org [Org1MSP]"Fix:Remove wallet-test folder.File or directory not foundFileNotFoundError: [Errno 2] No such file or directory:Fix:Check if fabric network is up. Check paths in network configuration file.DNS resolution failedstatus = StatusCode.UNAVAILABLEdetails = "DNS resolution failed"Fix:Check connection to peers. If using fabric_net, check thatautoauditor_dnscontainer is running.Failed to connectstatus = StatusCode.UNAVAILABLEdetails = "failed to connect to all addresses"Fix:Checkgrpc_request_endpointin network configuration file.Multiple definitions (libgroupsig)/usr/bin/ld: ...libgroupsig-static.a(groupsig.c.o):(.bss+0x0): multiple definition of `logger'; .../_groupsig.o:.../src/include/logger.h:118: first defined here/usr/bin/ld: ...libgroupsig-static.a(groupsig.c.o):(.bss+0x20): multiple definition of `sysenv'; .../_groupsig.o:.../src/include/sysenv.h:59: first defined hereFix:Addadd_link_options("LINKER:--allow-multiple-definition")tothird_party/libgroupsig/libgroupsig/CMakeLists.txt...# Global compiler flagsset(CMAKE_C_FLAGS"${CMAKE_C_FLAGS} -fPIC")set(CMAKE_CXX_FLAGS"${CMAKE_CXX_FLAGS} -fPIC")add_link_options("LINKER:--allow-multiple-definition")...Addextra_link_args=["-Wl,--allow-multiple-definition"]tothird_party/libgroupsig/libgroupsig/src/wrappers/python/pygroupsig/libgroupsig_build.py...c_mcl384_256_path,c_mcl_path,],extra_link_args=['-Wl,--allow-multiple-definition'])...AcknowledgementsThis work has been supported by National R&D Project TEC2017-84197-C4-1-R and by
the Comunidad de Madrid project CYNAMON P2018/TCS-4566 and co-financed by European
Structural Funds (ESF and FEDER)Licenseautoauditor  Copyright (C) 2020-2022 Sergio Chica Manjarrez @ pervasive.it.uc3m.es.
Universidad Carlos III de Madrid.
This program comes with ABSOLUTELY NO WARRANTY; for details check below.
This is free software, and you are welcome to redistribute it
under certain conditions; check below for details.LICENSE