├── .gitignore
├── README.md
├── __init__.py
├── admin.py
├── api.py
├── apps.py
├── functions.py
├── migrations
    └── __init__.py
├── models.py
├── pdf.py
├── static
    ├── async.js
    ├── custom.css
    ├── logo.png
    ├── logoblack.png
    ├── logomin.png
    └── report.css
├── templates
    └── nmapreport
    │   ├── index.html
    │   └── report.html
├── tests.py
├── urls.py
└── views.py


/.gitignore:
--------------------------------------------------------------------------------
 1 | # Django Recommended
 2 | *.egg-info
 3 | *.pot
 4 | *.py[co]
 5 | __pycache__
 6 | MANIFEST
 7 | dist/
 8 | docs/_build/
 9 | docs/locale/
10 | node_modules/
11 | tests/coverage_html/
12 | tests/.coverage
13 | build/
14 | tests/report/
15 | 
16 | # Sensitive Data
17 | credentials.py
18 | credentials.pyc
19 | 
20 | # Byte-compiled / optimized / DLL files
21 | __pycache__/
22 | *.py[cod]
23 | *$py.class
24 | 
25 | # C extensions
26 | *.so
27 | 
28 | # Distribution / packaging
29 | django-env/
30 | .Python
31 | env/
32 | build/
33 | develop-eggs/
34 | dist/
35 | downloads/
36 | eggs/
37 | .eggs/
38 | lib/
39 | lib64/
40 | parts/
41 | sdist/
42 | var/
43 | *.egg-info/
44 | .installed.cfg
45 | *.egg
46 | assets/ # The directory set as STATIC_ROOT where Apache creates new static files on live web servers.
47 | 
48 | # PyInstaller
49 | #  Usually these files are written by a python script from a template
50 | #  before PyInstaller builds the exe, so as to inject date/other infos into it.
51 | *.manifest
52 | *.spec
53 | 
54 | # Installer logs
55 | pip-log.txt
56 | pip-delete-this-directory.txt
57 | 
58 | # Unit test / coverage reports
59 | htmlcov/
60 | .tox/
61 | .coverage
62 | .coverage.*
63 | .cache
64 | nosetests.xml
65 | coverage.xml
66 | *,cover
67 | .hypothesis/
68 | 
69 | # Translations
70 | *.mo
71 | *.pot
72 | 
73 | # Django 
74 | *.log
75 | 
76 | # Sphinx documentation
77 | docs/_build/
78 | 
79 | # PyBuilder
80 | target/
81 | 
82 | #Ipython Notebook
83 | .ipynb_checkpoints
84 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | <p align="center">
 2 | <img width="300" src="https://i.imgur.com/puyIfHT.jpg" /><br>
 3 | A Web Dashbord for Nmap XML Report 
 4 | </p>
 5 | 
 6 | ![WebMap](https://i.imgur.com/U9S089v.png)
 7 | 
 8 | ![WebMap](https://i.imgur.com/Ptijc67.png)
 9 | 
10 | ![WebMap](https://i.imgur.com/alWZix9.png)
11 | 
12 | ## Table Of Contents
13 | - [Usage](#usage)
14 | - [Video](#video)
15 | - [Features](#features)
16 | - [XML Filenames](#xml-filenames)
17 | - [Third Parts](#third-parts)
18 | - [Security Issues](#security-issues)
19 | - [Contributors](#contributors)
20 | - [Contacts](#contacts)
21 | 
22 | ## Usage
23 | You should use this with docker, just by sending this command:
24 | ```bash
25 | $ mkdir /tmp/webmap
26 | $ docker run -d \
27 |          --name webmap \
28 |          -h webmap \
29 |          -p 8000:8000 \
30 |          -v /tmp/webmap:/opt/xml \
31 |          rev3rse/webmap /run.sh
32 | 
33 | $ # now you can run Nmap and save the XML Report on /tmp/webmap
34 | $ nmap -sT -A -T4 -oX /tmp/webmap/myscan.xml 192.168.1.0/24
35 | ```
36 | Now point your browser to http://localhost:8000
37 | 
38 | ## Video
39 | -- coming soon...
40 | 
41 | ## Features
42 | - Import and parse Nmap XML files
43 | - Statistics and Charts on discovered services, ports, OS, etc...
44 | - Inspect a single host by clicking on its IP address
45 | - Attach labels on a host
46 | - Insert notes for a specific host
47 | - Create a PDF Report with charts, details, labels and notes
48 | - Copy to clipboard as Nikto, Curl or Telnet commands
49 | 
50 | ## XML Filenames
51 | When creating the PDF version of the Nmap XML Report, the XML filename is used as document title on the first page. WebMap will replace some parts of the filename as following:
52 | 
53 | - `_` will replaced by a space (` `)
54 | - `.xml` will be removed
55 | 
56 | Example: `ACME_Ltd..xml`<br>
57 | PDF title: `ACME Ltd.`
58 | 
59 | ## Third Parts
60 | - [Django](https://www.djangoproject.com)
61 | - [Materialize CSS](https://materializecss.com)
62 | - [Clipboard.js](https://clipboardjs.com)
63 | - [Chart.js](https://www.chartjs.org)
64 | - [Wkhtmltopdf](https://wkhtmltopdf.org)
65 | 
66 | ## Security Issues
67 | This app is not intended to be exposed on the internet. Please, **DO NOT expose** this app to the internet, use your localhost or, in case you can't do it, take care to filter who and what can access to WebMap with a firewall rule or something like that. Exposing this app to the whole internet could lead not only to a stored XSS but also to a leakage of sensitive/critical/private informations about your port scan. Please, be smart.
68 | 
69 | ## Contributors
70 | This project is currently a beta, and I'm not super skilled on Django so, every type of contribution is appreciated. I'll mention all contributors in this section of the README file.
71 | 
72 | ### Contributors List
73 | - s3th_0x [@adubaldo](https://github.com/adubaldo) (bug on single host report)
74 | 
75 | ## Contacts
76 | Twitter: [@Menin_TheMiddle](https://twitter.com/Menin_TheMiddle)<br>
77 | YouTube: [Rev3rseSecurity](https://www.youtube.com/rev3rsesecurity)
78 | 


--------------------------------------------------------------------------------
/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/punitdarji/WebMap/ff553249f2b3f62d0e414f4c7f4991a4f2a65b16/__init__.py


--------------------------------------------------------------------------------
/admin.py:
--------------------------------------------------------------------------------
1 | from django.contrib import admin
2 | 
3 | # Register your models here.
4 | 


--------------------------------------------------------------------------------
/api.py:
--------------------------------------------------------------------------------
  1 | from django.shortcuts import render
  2 | from django.http import HttpResponse
  3 | import xmltodict, json, html, os, hashlib, re
  4 | from collections import OrderedDict
  5 | 
  6 | def rmNotes(request, hashstr):
  7 | 	scanfilemd5 = hashlib.md5(str(request.session['scanfile']).encode('utf-8')).hexdigest()
  8 | 	if re.match('^[a-f0-9]{32,32}$', hashstr) is not None:
  9 | 		os.remove('/opt/notes/'+scanfilemd5+'_'+hashstr+'.notes')
 10 | 		res = {'ok':'notes removed'}
 11 | 	else:
 12 | 		res = {'error':'invalid format'}
 13 | 
 14 | 	return HttpResponse(json.dumps(res), content_type="application/json")
 15 | 
 16 | def saveNotes(request):
 17 | 	if request.method == "POST":
 18 | 		scanfilemd5 = hashlib.md5(str(request.session['scanfile']).encode('utf-8')).hexdigest()
 19 | 
 20 | 		if re.match('^[a-f0-9]{32,32}$', request.POST['hashstr']) is not None:
 21 | 			f = open('/opt/notes/'+scanfilemd5+'_'+request.POST['hashstr']+'.notes', 'w')
 22 | 			f.write(request.POST['notes'])
 23 | 			f.close()
 24 | 			res = {'ok':'notes saved'}
 25 | 	else:
 26 | 		res = {'error': request.method }
 27 | 
 28 | 	return HttpResponse(json.dumps(res), content_type="application/json")
 29 | 
 30 | def rmlabel(request, objtype, hashstr):
 31 | 	types = {
 32 | 		'host':True,
 33 | 		'port':True
 34 | 	}
 35 | 
 36 | 	scanfilemd5 = hashlib.md5(str(request.session['scanfile']).encode('utf-8')).hexdigest()
 37 | 
 38 | 	if re.match('^[a-f0-9]{32,32}$', hashstr) is not None:
 39 | 		os.remove('/opt/notes/'+scanfilemd5+'_'+hashstr+'.'+objtype+'.label')
 40 | 		res = {'ok':'label removed'}
 41 | 		return HttpResponse(json.dumps(res), content_type="application/json")
 42 | 
 43 | def label(request, objtype, label, hashstr):
 44 | 	labels = {
 45 | 		'Vulnerable':True,
 46 | 		'Critical':True,
 47 | 		'Warning':True,
 48 | 		'Checked':True
 49 | 	}
 50 | 
 51 | 	types = {
 52 | 		'host':True,
 53 | 		'port':True
 54 | 	}
 55 | 
 56 | 	scanfilemd5 = hashlib.md5(str(request.session['scanfile']).encode('utf-8')).hexdigest()
 57 | 
 58 | 	if label in labels and objtype in types:
 59 | 		if re.match('^[a-f0-9]{32,32}$', hashstr) is not None:
 60 | 			f = open('/opt/notes/'+scanfilemd5+'_'+hashstr+'.'+objtype+'.label', 'w')
 61 | 			f.write(label)
 62 | 			f.close()
 63 | 			res = {'ok':'label set', 'label':str(label)}
 64 | 			return HttpResponse(json.dumps(res), content_type="application/json")
 65 | 
 66 | def port_details(request, address, portid):
 67 | 	r = {}
 68 | 	oo = xmltodict.parse(open('/opt/xml/'+request.session['scanfile'], 'r').read())
 69 | 	r['out'] = json.dumps(oo['nmaprun'], indent=4)
 70 | 	o = json.loads(r['out'])
 71 | 
 72 | 	for ik in o['host']:
 73 | 
 74 | 		# this fix single host report
 75 | 		if type(ik) is dict:
 76 | 			i = ik
 77 | 		else:
 78 | 			i = o['host']
 79 | 
 80 | 		if '@addr' in i['address']:
 81 | 			saddress = i['address']['@addr']
 82 | 		elif type(i['address']) is list:
 83 | 			for ai in i['address']:
 84 | 				if ai['@addrtype'] == 'ipv4':
 85 | 					saddress = ai['@addr'] 
 86 | 
 87 | 		if str(saddress) == address:
 88 | 			for pobj in i['ports']['port']:
 89 | 				if type(pobj) is dict:
 90 | 					p = pobj
 91 | 				else:
 92 | 					p = i['ports']['port']
 93 | 
 94 | 				if p['@portid'] == portid:
 95 | 					return HttpResponse(json.dumps(p, indent=4), content_type="application/json")
 96 | 
 97 | def genPDF(request):
 98 | 	if 'scanfile' in request.session:
 99 | 		pdffile = hashlib.md5(str(request.session['scanfile']).encode('utf-8')).hexdigest()
100 | 		if os.path.exists('/opt/nmapdashboard/nmapreport/static/'+pdffile+'.pdf'):
101 | 			os.remove('/opt/nmapdashboard/nmapreport/static/'+pdffile+'.pdf')
102 | 
103 | 		os.popen('/opt/wkhtmltox/bin/wkhtmltopdf --cookie sessionid '+request.session._session_key+' --enable-javascript --javascript-delay 6000 http://127.0.0.1:8000/view/pdf/ /opt/nmapdashboard/nmapreport/static/'+pdffile+'.pdf')
104 | 		res = {'ok':'PDF created', 'file':'/static/'+pdffile+'.pdf'}
105 | 		return HttpResponse(json.dumps(res), content_type="application/json")
106 | 


--------------------------------------------------------------------------------
/apps.py:
--------------------------------------------------------------------------------
1 | from django.apps import AppConfig
2 | 
3 | 
4 | class NmapreportConfig(AppConfig):
5 |     name = 'nmapreport'
6 | 


--------------------------------------------------------------------------------
/functions.py:
--------------------------------------------------------------------------------
 1 | def labelToMargin(label):
 2 | 	labels = {
 3 | 		'Vulnerable':'10px',
 4 | 		'Critical':'22px',
 5 | 		'Warning':'28px',
 6 | 		'Checked':'28px'
 7 | 	}
 8 | 
 9 | 	if label in labels:
10 | 		return labels[label]
11 | 
12 | def labelToColor(label):
13 | 	labels = {
14 | 		'Vulnerable':'red',
15 | 		'Critical':'black',
16 | 		'Warning':'orange',
17 | 		'Checked':'blue'
18 | 	}
19 | 
20 | 	if label in labels:
21 | 		return labels[label]
22 | 
23 | def fromOSTypeToFontAwesome(ostype):
24 | 	icons = {
25 | 		'windows':'fab fa-windows',
26 | 		'solaris':'fab fa-linux',	# there isn't a better icon on fontawesome :(
27 | 		'unix':'fab fa-linux',		# same here...
28 | 		'linux':'fab fa-linux',
29 | 	}
30 | 
31 | 	if ostype.lower() in icons:
32 | 		return str(icons[ostype.lower()])
33 | 	else:
34 | 		return 'fas fa-question'
35 | 


--------------------------------------------------------------------------------
/migrations/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/punitdarji/WebMap/ff553249f2b3f62d0e414f4c7f4991a4f2a65b16/migrations/__init__.py


--------------------------------------------------------------------------------
/models.py:
--------------------------------------------------------------------------------
1 | from django.db import models
2 | 
3 | # Create your models here.
4 | 


--------------------------------------------------------------------------------
/pdf.py:
--------------------------------------------------------------------------------
  1 | from django.shortcuts import render
  2 | from django.http import HttpResponse
  3 | import xmltodict, json, html, os, hashlib, re, urllib.parse, base64
  4 | from collections import OrderedDict
  5 | from nmapreport.functions import *
  6 | #from view import labelToColor
  7 | 
  8 | def reportPDFView(request):
  9 | 	r = { 'out':'' }
 10 | 	filterscriptid = {
 11 | 	}
 12 | 
 13 | 	if 'scanfile' in request.session:
 14 | 		oo = xmltodict.parse(open('/opt/xml/'+request.session['scanfile'], 'r').read())
 15 | 		r['out2'] = json.dumps(oo['nmaprun'], indent=4)
 16 | 		o = json.loads(r['out2'])
 17 | 	else:
 18 | 		return HttpResponse('error: scan file not loaded', content_type="text/html")	
 19 | 
 20 | 	r['html'] = ''
 21 | 	hostdetails = ''
 22 | 	counters = {'po':0,'pc':0,'pf':0,'hostsup':0,'ostype':{},'pi':{},'ss':{}}
 23 | 
 24 | 	scanmd5 = hashlib.md5(str(request.session['scanfile']).encode('utf-8')).hexdigest()
 25 | 	for ik in o['host']:
 26 | 
 27 | 		# this fix single host report
 28 | 		if type(ik) is dict:
 29 | 			i = ik
 30 | 		else:
 31 | 			i = o['host']
 32 | 
 33 | 		hostcounters = {'po':0,'pc':0,'pf':0,'ostype':{},'pi':{},'ss':{}}
 34 | 		hostdetails_html = ''
 35 | 		portsfound = False
 36 | 		striggered = False
 37 | 		lastportid = 0
 38 | 
 39 | 		saddress = 'noaddress'
 40 | 
 41 | 		if '@addr' in i['address']:
 42 | 			saddress = i['address']['@addr']
 43 | 		elif type(i['address']) is list:
 44 | 			for ai in i['address']:
 45 | 				if ai['@addrtype'] == 'ipv4':
 46 | 					saddress = ai['@addr'] 
 47 | 
 48 | 		addressmd5 = hashlib.md5(str(saddress).encode('utf-8')).hexdigest()
 49 | 
 50 | 		# collect all labels in labelhost dict
 51 | 		labelhost = {}
 52 | 		labelfiles = os.listdir('/opt/notes')
 53 | 		for lf in labelfiles:
 54 | 			m = re.match('^('+scanmd5+')_([a-z0-9]{32,32})\.host\.label$', lf)
 55 | 			if m is not None:
 56 | 				if m.group(1) not in labelhost:
 57 | 					labelhost[m.group(1)] = {}
 58 | 				labelhost[m.group(1)][m.group(2)] = open('/opt/notes/'+lf, 'r').read()
 59 | 
 60 | 		# collect all notes in noteshost dict
 61 | 		noteshost = {}
 62 | 		notesfiles = os.listdir('/opt/notes')
 63 | 		for nf in notesfiles:
 64 | 			m = re.match('^('+scanmd5+')_([a-z0-9]{32,32})\.notes$', nf)
 65 | 			if m is not None:
 66 | 				if m.group(1) not in noteshost:
 67 | 					noteshost[m.group(1)] = {}
 68 | 				noteshost[m.group(1)][m.group(2)] = open('/opt/notes/'+nf, 'r').read()
 69 | 
 70 | 		if i['status']['@state'] == 'up':
 71 | 			labelout = ''
 72 | 			if scanmd5 in labelhost:
 73 | 				if addressmd5 in labelhost[scanmd5]:
 74 | 					labelcolor = labelToColor(labelhost[scanmd5][addressmd5])
 75 | 					# labelmargin = labelToMargin(labelhost[scanmd5][addressmd5])
 76 | 					labelout = '<span style="" class="label '+labelcolor+'">'+html.escape(labelhost[scanmd5][addressmd5])+'</span>'
 77 | 
 78 | 			hostdetails_html += '<div style="page-break-before: always;">'
 79 | 			hostdetails_html += '	<h2>'+html.escape(saddress)+' '+labelout+'</h2> '
 80 | 
 81 | 			hostdetails_html += '	<span class="subtitle">Status: '+html.escape(i['status']['@state'])+', '
 82 | 			hostdetails_html += 'Reason: '+html.escape(i['status']['@reason'])+', '
 83 | 			hostdetails_html += 'TTL: '+html.escape(i['status']['@reason_ttl'])+'</span>'
 84 | 
 85 | 			if 'hostsup' in counters:
 86 | 				counters['hostsup'] = (counters['hostsup'] + 1)
 87 | 			else:
 88 | 				counters['hostsup'] = 1
 89 | 
 90 | 		hostdetails_html_tr = ''
 91 | 		portdetails_html_tr = ''
 92 | 		if 'ports' in i and 'port' in i['ports']:
 93 | 			for pobj in i['ports']['port']:
 94 | 				if type(pobj) is dict:
 95 | 					p = pobj
 96 | 				else:
 97 | 					p = i['ports']['port']
 98 | 
 99 | 				if p['@portid'] != lastportid:
100 | 					lastportid = p['@portid']
101 | 				else:
102 | 					continue;
103 | 
104 | 				hdhtml_stateico = ''
105 | 				if p['state']['@state'] == 'closed':
106 | 					hdhtml_stateico = '<i class="fas fa-door-closed red-text"></i>'
107 | 					counters['pc'] = (counters['pc'] + 1)
108 | 					hostcounters['pc'] = (hostcounters['pc'] + 1)
109 | 				elif p['state']['@state'] == 'open':
110 | 					hdhtml_stateico = '<i class="fas fa-door-open green-text"></i>'
111 | 					counters['po'] = (counters['po'] + 1)
112 | 					hostcounters['po'] = (hostcounters['po'] + 1)
113 | 				elif p['state']['@state'] == 'filtered':
114 | 					hdhtml_stateico = '<i class="fas fa-filter grey-text"></i>'
115 | 					counters['pf'] = (counters['pf'] + 1)
116 | 					hostcounters['pf'] = (hostcounters['pf'] + 1)
117 | 
118 | 				if '@ostype' in p['service']:
119 | 					if p['service']['@ostype'] in counters['ostype']:
120 | 						counters['ostype'][p['service']['@ostype']] = (counters['ostype'][p['service']['@ostype']] +1)
121 | 					else:
122 | 						counters['ostype'][p['service']['@ostype']] = 1;
123 | 
124 | 				if p['service']['@name'] in counters['ss']:
125 | 					counters['ss'][p['service']['@name']] = (counters['ss'][p['service']['@name']] + 1)
126 | 				else:
127 | 					counters['ss'][p['service']['@name']] = 1
128 | 
129 | 				if p['@portid'] in counters['pi']:
130 | 					counters['pi'][p['@portid']] = (counters['pi'][p['@portid']] + 1)
131 | 				else:
132 | 					counters['pi'][p['@portid']] = 1
133 | 
134 | 				hdhtml_product = ''
135 | 				if '@product' in p['service']:
136 | 					hdhtml_product = html.escape(p['service']['@product'])
137 | 				else:
138 | 					hdhtml_product = '<i class="grey-text">No Product</i>'
139 | 
140 | 				hdhtml_version = ''
141 | 				if '@version' in p['service']:
142 | 					hdhtml_version = html.escape(p['service']['@version'])
143 | 				else:
144 | 					hdhtml_version = '<i class="grey-text">No Version</i>'
145 | 
146 | 				hdhtml_protocolor = 'grey'
147 | 				if p['@protocol'] == 'tcp':
148 | 					hdhtml_protocolor = 'blue'
149 | 				elif p['@protocol'] == 'udp':
150 | 					hdhtml_protocolor = 'red'
151 | 				
152 | 				hostdetails_html_tr += '<tr>'+\
153 | 				'	<td><span class="'+hdhtml_protocolor+'-text">'+p['@protocol']+'</span> / <span class=""><b>'+p['@portid']+'</b></span><br><span class="small">'+p['service']['@name']+'</span></td>'+\
154 | 				'	<td>'+hdhtml_stateico+' '+p['state']['@state']+'</td>'+\
155 | 				'	<td>'+hdhtml_product+' / '+hdhtml_version+'</td>'+\
156 | 				'</tr>'
157 | 
158 | 				if 'script' in p:
159 | 					lastscript = ''
160 | 					for ii in p['script']:
161 | 						if type(ii) is dict:
162 | 							script = ii
163 | 						else:
164 | 							script = p['script']
165 | 
166 | 						if lastscript != script['@id']:
167 | 							lastscript = script['@id']
168 | 						else:
169 | 							continue
170 | 
171 | 						if script['@output'].replace('\n','') != '' and script['@id'] not in filterscriptid:
172 | 							portdetails_html_tr += '<div class="extratitle"><b class="red-text">'+html.escape(script['@id'])+'</b> - Address: <b>'+html.escape(saddress)+'</b> - Port: <b>'+p['@portid']+'</b></div>'+\
173 | 							'<div class="extrainfo">'+html.escape(script['@output']).replace('\n','<br>')+'</div>'
174 | 
175 | 				portsfound = True
176 | 
177 | 		notesout,notesb64 = '',''
178 | 		if scanmd5 in noteshost:
179 | 			if addressmd5 in noteshost[scanmd5]:
180 | 				notesb64 = noteshost[scanmd5][addressmd5]
181 | 				notesout = '<div style="page-break-before: always;">'+\
182 | 				'	<h3>Notes for host '+saddress+'</h3>'+\
183 | 				'	'+base64.b64decode(urllib.parse.unquote(notesb64)).decode('ascii')+\
184 | 				'</div>'
185 | 
186 | 
187 | 
188 | 		if i['status']['@state'] == 'up':
189 | 			hostdetails_html += '<div class="row margintb">'+\
190 | 			'		<div class="col s3"><center><h3><i class="fab fa-creative-commons-sampling"></i> '+str(hostcounters['po']+hostcounters['pc']+hostcounters['pf'])+'</h3>TOTAL PORT</center></div>'+\
191 | 			'		<div class="col s3 bleft""><center><h3><i class="fas fa-door-open green-text"></i> '+str(hostcounters['po'])+'</h3>OPEN PORT</center></div>'+\
192 | 			'		<div class="col s3 bleft"><center><h3><i class="fas fa-door-closed red-text"></i> '+str(hostcounters['pc'])+'</h3>CLOSED PORT</center></div>'+\
193 | 			'		<div class="col s3 bleft"><center><h3><i class="fas fa-filter grey-text"></i> '+str(hostcounters['pf'])+'</h3>FILTERED PORT</center></div>'+\
194 | 			'	</div>'+\
195 | 			'	<table><thead><tr><th>Protocol / Port</th><th>Port State</th><th>Product / Version</th></tr></thead><tbody>'+\
196 | 			hostdetails_html_tr+\
197 | 			'</tbody></table></div>'+\
198 | 			'<div class="">'+portdetails_html_tr+'</div>'+\
199 | 			notesout
200 | 
201 | 		if portsfound is True:
202 | 			# r['out'] += '1,'
203 | 			hostdetails += hostdetails_html
204 | 		#else:
205 | 		#	r['out'] += '0,'
206 | 
207 | 		# this fix single host report
208 | 		if type(ik) is not dict:
209 | 			break;
210 | 
211 | 
212 | 	html_ports = ''
213 | 	javascript_ports = ''
214 | 	for ii in counters['pi']:
215 | 		html_ports += '<b>'+str(ii)+'</b> <span class="grey-text">('+str(counters['pi'][ii])+')</span>, '
216 | 		javascript_ports += '["'+str(ii)+'", '+str(counters['pi'][ii])+'],'
217 | 
218 | 	html_services = ''
219 | 	javascript_services = ''
220 | 	for ii in counters['ss']:
221 | 		html_services += '<b>'+str(ii)+'</b> <span class="grey-text">('+str(counters['ss'][ii])+')</span>, '
222 | 		javascript_services += '["'+str(ii)+'", '+str(counters['ss'][ii])+'],'
223 | 
224 | 
225 | 	r['html'] += '<script type="text/javascript" src="https://www.google.com/jsapi?autoload={%27modules%27:[{%27name%27:%27visualization%27,%27version%27:%271.1%27,%27packages%27:[%27corechart%27,%27sankey%27,%27annotationchart%27]}]}"></script>'+\
226 | 	'<div class="container"><div style="text-align:center;width:100%;">'+\
227 | 	'	<img src="/static/logoblack.png" style="height:60px;" />'+\
228 | 	'	<h1 style="margin-top:300px;">Port Scan Report</h1>'+\
229 | 	'	<span class="subtitle">'+html.escape(request.session['scanfile'].replace('.xml','').replace('_',' '))+'</span><br>'+\
230 | 	'	<div style="margin-top:200px;font-size:18px;padding:20px;"><table class="striped">'+\
231 | 	'	<thead>'+\
232 | 	'		<tr><th style="min-width:200px;">&nbsp;</th><th></th></tr>'+\
233 | 	'	</thead>'+\
234 | 	'	<tbody>'+\
235 | 	'		<tr><td><b>Arguments:</b></td><td>'+html.escape(o['@args'])+'</td></tr>'+\
236 | 	'		<tr><td><b>Scan started at:</b></td><td>'+html.escape(o['@startstr'])+'</td></tr>'+\
237 | 	'		<tr><td><b>Scan type:</b></td><td>'+html.escape(o['scaninfo']['@type'])+'</td></tr>'+\
238 | 	'		<tr><td><b>Nmap version:</b></td><td>'+html.escape(o['@version'])+'</td></tr>'+\
239 | 	'	</tbody></table></div>'+\
240 | 	'	<div style="color:#999;margin-top:100px;font-size:18px;"><i>The information contained in these documents is confidential, privileged and only for the information of the intended recipient and may not be used, published or redistributed.</i></div>'+\
241 | 	'</div></div><br>'+\
242 | 	'<div style="page-break-before: always;">'+\
243 | 	'	<h2>Ports and Services</h2><div class="subtitle">Ports status and services type</div>'+\
244 | 	'	<div class="row" style="margin-top:30px;border-bottom:solid #ccc 1px;padding:10px;">'+\
245 | 	'		<div class="col s3"><b class="blue-text" style="font-size:24px;">HOSTS UP</b><br><span style="color:#999;font-size:32px;">'+str(counters['hostsup'])+'</span></div>'+\
246 | 	'		<div class="col s3" style="border-left:solid #ccc 1px;"><b class="blue-text" style="font-size:24px;">PORTS</b><br><span style="color:#999;font-size:32px;">'+str(counters['pc']+counters['po']+counters['pf'])+'</span></div>'+\
247 | 	'		<div class="col s3" style="border-left:solid #ccc 1px;"><b class="blue-text" style="font-size:24px;">SERVICES</b><br><span style="color:#999;font-size:32px;">'+str(len(counters['ss'].keys()))+'</span></div>'+\
248 | 	'		<div class="col s3" style="border-left:solid #ccc 1px;"><b class="blue-text" style="font-size:24px;">OS</b><br><span style="color:#999;font-size:32px;">'+str(len(counters['ostype'].keys()))+'</span></div>'+\
249 | 	'	</div>'+\
250 | 	'	<div class="row" style="margin-top:50px;">'+\
251 | 	'		<div class="col s8">'+\
252 | 	'			<div style="width:400px;height:300px;" id="chart_portstatus"></div>'+\
253 | 	'			<div style="width:400px;height:300px;" id="chart_ports"></div>'+\
254 | 	'			<div style="width:400px;height:300px;" id="chart_services"></div>'+\
255 | 	'		</div>'+\
256 | 	'		<div class="col s4" style="border-left:solid #ccc 1px;padding-left:20px;min-height:300px;">'+\
257 | 	'			<b class="subtitle">Total Ports</b><br><span class="subtitle">'+str(counters['pc']+counters['po']+counters['pf'])+'</span><br><br>'+\
258 | 	'			<b class="subtitle green-text">Open Ports</b><br><span class="subtitle green-text">'+str(counters['po'])+'</span><br><br>'+\
259 | 	'			<b class="subtitle red-text">Closed Ports</b><br><span class="subtitle red-text">'+str(counters['pc'])+'</span><br><br>'+\
260 | 	'			<b class="subtitle orange-text">Filtered Ports</b><br><span class="subtitle orange-text">'+str(counters['pf'])+'</span><br><br>'+\
261 | 	'			<b>Ports</b>:<br><span style="font-family:monospace;font-size:11px;">'+html_ports[0:-2]+'</span><br><br>'+\
262 | 	'			<b>Services</b>:<br><span style="font-family:monospace;font-size:11px;">'+html_services[0:-2]+'</span>'+\
263 | 	'		</div>'+\
264 | 	'</div>'
265 | 
266 | 	r['html'] += '<script type="text/javascript">'+\
267 | 	'$(document).ready(function() {'+\
268 | 	'	drawChart();'+\
269 | 	'});'+\
270 | 	'function drawChart() {'+\
271 | 	'	var data = new google.visualization.DataTable();'+\
272 | 	'	data.addColumn("string", "State");'+\
273 | 	'	data.addColumn("number", "Count");'+\
274 | 	'	data.addRows(['+\
275 | 	'		["Open", '+str(counters['po'])+'],'+\
276 | 	'		["Closed", '+str(counters['pc'])+'],'+\
277 | 	'		["Filtered", '+str(counters['pf'])+'],'+\
278 | 	'	]);'+\
279 | 	'	var options = {'+\
280 | 	'		"title":"Port Status",'+\
281 | 	'		"width":500,'+\
282 | 	'		"height":300,'+\
283 | 	'		"is3D": true,'+\
284 | 	'		chartArea: {width:"100%",height:"90%"},'+\
285 | 	'		"legend": {'+\
286 | 	'			"position": "labeled"'+\
287 | 	'		}'+\
288 | 	'	};'+\
289 | 	'	var chart = new google.visualization.PieChart(document.getElementById("chart_portstatus"));'+\
290 | 	'	chart.draw(data, options);'+\
291 | 	''+\
292 | 	'	var data = new google.visualization.DataTable();'+\
293 | 	'	data.addColumn("string", "Ports");'+\
294 | 	'	data.addColumn("number", "Count");'+\
295 | 	'	data.addRows(['+\
296 | 	javascript_ports+\
297 | 	'	]);'+\
298 | 	'	var options = {'+\
299 | 	'		"title":"Ports list",'+\
300 | 	'		"width":500,'+\
301 | 	'		"height":300,'+\
302 | 	'		"is3D": true,'+\
303 | 	'		chartArea: {width:"100%",height:"90%"},'+\
304 | 	'		"legend": {'+\
305 | 	'			"position": "labeled"'+\
306 | 	'		}'+\
307 | 	'	};'+\
308 | 	'	var chart = new google.visualization.PieChart(document.getElementById("chart_ports"));'+\
309 | 	'	chart.draw(data, options);'+\
310 | 	''+\
311 | 	'	var data = new google.visualization.DataTable();'+\
312 | 	'	data.addColumn("string", "Ports");'+\
313 | 	'	data.addColumn("number", "Count");'+\
314 | 	'	data.addRows(['+\
315 | 	javascript_services+\
316 | 	'	]);'+\
317 | 	'	var options = {'+\
318 | 	'		"title":"Services list",'+\
319 | 	'		"width":500,'+\
320 | 	'		"height":300,'+\
321 | 	'		"is3D": true,'+\
322 | 	'		chartArea: {width:"100%",height:"90%"},'+\
323 | 	'		"legend": {'+\
324 | 	'			"position": "labeled"'+\
325 | 	'		}'+\
326 | 	'	};'+\
327 | 	'	var chart = new google.visualization.PieChart(document.getElementById("chart_services"));'+\
328 | 	'	chart.draw(data, options);'+\
329 | 	'}'+\
330 | 	'</script>'
331 | 
332 | 	r['html'] += hostdetails
333 | 
334 | 	r['html'] += ''+\
335 | 	'<div style="page-break-before: always;">'+\
336 | 	'	<div>'+\
337 | 	'		<div style="text-align:center;padding-top:600px;"><b>Generated with</b><br>'+\
338 | 	'			<img src="/static/logoblack.png" style="height:60px;" /><br>'+\
339 | 	'			<a href="https://github.com/Rev3rseSecurity/WebMap">https://github.com/Rev3rseSecurity/WebMap</a>'+\
340 | 	'		</div>'+\
341 | 	'	</div>'+\
342 | 	'</div>'
343 | 
344 | 	return render(request, 'nmapreport/report.html', r)
345 | 
346 | 
347 | 


--------------------------------------------------------------------------------
/static/async.js:
--------------------------------------------------------------------------------
  1 | $(document).ready(function() {
  2 | 	// doc ready
  3 | });
  4 | 
  5 | function genPDF(md5scan) {
  6 | 	if(/^[a-f0-9]{32,32}$/.test(md5scan)) {
  7 | 		$.get('/report/api/pdf/').done(function(data) {
  8 | 			console.log(data);
  9 | 			$('#modal1').css('background-color','#3e3e3e');
 10 | 			$('#modaltitle').html('Generating PDF Report');
 11 | 		
 12 | 			$('#modalbody').html('Please wait a few seconds...<br>'+
 13 | 			'<div class="progress"><div class="indeterminate"></div></div>'+
 14 | 			'<br><br>You\'ll be redirected to the PDF Report:<br>')
 15 | 			$('#modal1').modal('open');
 16 | 		});
 17 | 
 18 | 		var pdfcheck = setInterval(function() {
 19 | 			$.get('/static/'+md5scan+'.pdf')
 20 | 			.done(function() { $('#modalbody').append('PDF ready! Please wait...<br>'); setTimeout(function() { location.href='/static/'+md5scan+'.pdf' }, 3000); })
 21 | 			.fail(function() { $('#modalbody').append('<i>PDF not ready yet...</i><br>'); });
 22 | 		}, 2000);
 23 | 	}
 24 | }
 25 | 
 26 | function removeNotes(hashstr, i) {
 27 | 	$.get('/report/api/rmnotes/'+hashstr+'/').done(function(data) {
 28 | 		if(data['ok'] == 'notes removed') {
 29 | 			$('#noteshost'+i).remove();
 30 | 		}
 31 | 	});
 32 | }
 33 | 
 34 | function saveNotes() {
 35 | 	nb64 = encodeURIComponent(btoa($('#notes').val()));
 36 | 	csrftoken = $('input[name="csrfmiddlewaretoken"]').val();
 37 | 	hashstr = $('#hashstr').val();
 38 | 	console.log(hashstr);
 39 | 	$.post('/report/api/savenotes/', {
 40 | 		'notes': nb64,
 41 | 		'csrfmiddlewaretoken': csrftoken,
 42 | 		'hashstr': hashstr
 43 | 	 }).done(function(d) {
 44 | 		console.log(d);
 45 | 		if(typeof(d['ok']) !== 'undefined' && d['ok'] == 'notes saved') {
 46 | 			$('#modalbody').html('<span class="green-text">Notes successfully saved!</span><br> Now this page needs a reload. Please, click on the &quot;Reload&quot; button.');
 47 | 			$('#modalfooter').html('<button class="btn blue" onclick="javascript:location.reload();">Reload</button>');
 48 | 		}
 49 | 	});
 50 | }
 51 | 
 52 | function openNotes(hashstr, notesb64) {
 53 | 	if(/^[a-f0-9]{32,32}$/.test(hashstr)) {
 54 | 		if(notesb64 != '') {
 55 | 			savednotes = atob(decodeURIComponent(notesb64));
 56 | 		} else {
 57 | 			savednotes = ''
 58 | 		}
 59 | 		$('#modal1').css('background-color','#3e3e3e');
 60 | 		$('#modaltitle').html('Save Notes');
 61 | 		$('#modalbody').html(
 62 | 			'In the text area below, you can insert notes that will appear on the PDF report. '+
 63 | 			'All input here are <b class="blue-text">intentionally not sanitized</b>, so you can use HTML markup and JavaScript. '+
 64 | 			'Please, keep in mind that <b class="orange-text">you can break the PDF View HTML</b> and, of course, this represents a stored XSS vector.<br><br>'+
 65 | 			'<textarea id="notes" style="color:#fff;min-height:160px;">'+$('<span/>').text(savednotes).html()+'</textarea>'+
 66 | 			'<input type="hidden" id="hashstr" value="'+hashstr+'" /><br><br>'+
 67 | 			'<b>Tips:</b><br>'+
 68 | 			'<code class="grey-text">&lt;b&gt;bold text&lt;/b&gt;</code> = <b>bold text</b><br>'+
 69 | 			'<code class="grey-text">&lt;i&gt;italic text&lt;/i&gt;</code> = <i>italic text</i><br>'+
 70 | 			'<code class="grey-text">&lt;span class="label green"&gt;A green label&lt;/span&gt;</code> = <span class="label green">A green label</span><br>'+
 71 | 			'<code class="grey-text">&lt;code&gt;monospace font&lt;/code&gt;</code> = <code>monospace font</code>'
 72 | 		);
 73 | 		$('#modalfooter').html('<button onclick="javascript:saveNotes();" class="waves-effect waves-green btn grey white-text">Save</button>');
 74 | 		$('#modal1').modal('open');
 75 | 	}
 76 | }
 77 | 
 78 | function apiPortDetails(address, portid) {
 79 | 	$.get('/report/api/'+address+'/'+portid+'/').done(function(data) {
 80 | 		console.log(data);
 81 | 
 82 | 		$('#modaltitle').html('Port Details: <span class="blue-text">'+$('<span/>').text(data['@portid']).html()+' / '+$('<span/>').text(data['@protocol']).html()+'</span>');
 83 | 
 84 | 		tbody = ''
 85 | 		ingorescriptid = {
 86 | 			'fingerprint-strings':true
 87 | 		}
 88 | 
 89 | 		console.log(typeof(data['script']));
 90 | 		if(typeof(data['script']) !== 'undefined') {
 91 | 			if(typeof(data['script']) === 'object' && typeof(data['script']['@id']) === 'undefined') {
 92 | 				for(sid in data['script']) {
 93 | 					if(typeof(ingorescriptid[data['script'][sid]['@id']]) !== 'undefined') { continue; }
 94 | 					tbody += '<tr><td class="orange-text">'+$('<span/>').text(data['script'][sid]['@id']).html()+'</td><td style="font-family:monospace;font-size:12px;">'+$('<span/>').text(data['script'][sid]['@output']).html()+'</td></tr>'
 95 | 				}
 96 | 			} else {
 97 | 				if(typeof(ingorescriptid[data['script']['@id']]) === 'undefined') {
 98 | 					tbody += '<tr><td class="orange-text">'+$('<span/>').text(data['script']['@id']).html()+'</td><td style="font-family:monospace;font-size:12px;">'+$('<span/>').text(data['script']['@output']).html()+'</td></tr>'
 99 | 				}
100 | 			}
101 | 		} else {
102 | 			tbody += '<tr><td><i>none</i></td><td><i>none</i></td></tr>'
103 | 		}
104 | 
105 | 		$('#modal1').css('background-color','#3e3e3e');
106 | 
107 | 		$('#modalbody').html('<table class="table"><thead><th style="min-width:200px;">Script ID</th><th>Output</th></thead><tbody>'+tbody+'</tbody></table>');
108 | 		$('#modalbody').append('<br><b>Raw Output:</b><br><pre>'+$('<span/>').text(JSON.stringify(data, null, 4)).html()+'</pre>');
109 | 		$('#modal1').modal('open');
110 | 	});
111 | }
112 | 
113 | function removeLabel(type, hashstr, i) {
114 | 	$.get('/report/api/rmlabel/'+type+'/'+hashstr+'/').done(function(data) {
115 | 		if(data['ok'] == 'label removed') {
116 | 			$('#hostlabel'+i).attr("class","")
117 | 			$('#hostlabel'+i).html("");
118 | 		}
119 | 	});
120 | }
121 | 
122 | function setLabel(type, label, hashstr, i) {
123 | 	$.get('/report/api/setlabel/'+type+'/'+label+'/'+hashstr+'/').done(function(data) {
124 | 		console.log(data);
125 | 		var res = data;
126 | 		var color = 'grey'; var margin = '10px';
127 | 		if(res['ok'] == 'label set') {
128 | 			switch(res['label']) {
129 | 				case 'Vulnerable': color = 'red'; margin = '10px'; break;
130 | 				case 'Critical': color = 'black'; margin = '22px'; break;
131 | 				case 'Warning': color = 'orange'; margin = '28px'; break;
132 | 				case 'Checked': color = 'blue'; margin = '28px'; break;
133 | 			}
134 | 			$('#hostlabel'+i).css("margin-left", margin)
135 | 			$('#hostlabel'+i).attr("class","")
136 | 			$('#hostlabel'+i).addClass('rightlabel');
137 | 			$('#hostlabel'+i).addClass(color);
138 | 			$('#hostlabel'+i).html(res['label']);
139 | 		}
140 | 	});
141 | }
142 | 


--------------------------------------------------------------------------------
/static/custom.css:
--------------------------------------------------------------------------------
 1 | body {
 2 | 	background-color:#333333;
 3 | 	color:#eeeeee;
 4 | }
 5 | 
 6 | .scantitle {
 7 | 	padding-left:20px;
 8 | }
 9 | 
10 | .rightlabel {
11 | 	border-radius:2px;
12 | 	font-size:10px;
13 | 	font-family:monospace;
14 | 	text-align:center;
15 | 	position:absolute;
16 | 	padding-left:8px;
17 | 	padding-right:8px;
18 | 	margin-left:10px;
19 | 	margin-top:-20px;
20 | }
21 | 
22 | 
23 | .leftlabel {
24 | 	border-radius:2px;
25 | 	font-size:10px;
26 | 	font-family:monospace;
27 | 	text-align:center;
28 | 	position:absolute;
29 | 	padding-left:8px;
30 | 	padding-right:8px;
31 | 	margin-left:-29px;
32 | 	margin-top:-14px;
33 | }
34 | 
35 | .small {
36 | 	font-size:12px;
37 | }
38 | 
39 | .tmlabel {
40 | 	font-family: monospace;
41 | 	font-size: 12px;
42 | 	background-color: #999;
43 | 	border-radius: 4px;
44 | 	padding: 2px;
45 | 	padding-left: 4px;
46 | 	padding-right: 4px;
47 | 	color: #fff;
48 | }
49 | 
50 | .perco {
51 | 	border-radius: 2px;
52 | 	background-color:#090;
53 | 	font-size:10px;
54 | 	font-family:monospace;
55 | 	color:#eee;
56 | 	text-align:center;
57 | }
58 | 
59 | .percf {
60 | 	border-radius: 2px;
61 | 	background-color:#999;
62 | 	font-size:10px;
63 | 	font-family:monospace;
64 | 	color:#eee;
65 | 	text-align:center;
66 | }
67 | 
68 | .percc {
69 | 	border-radius: 2px;
70 | 	background-color:#f00;
71 | 	font-size:10px;
72 | 	font-family:monospace;
73 | 	color:#eee;
74 | 	text-align:center;
75 | }
76 | 
77 | .label {
78 | 	padding:6px;
79 | 	border-radius:4px;
80 | 	font-size:12px;
81 | 	color:#fff;
82 | }
83 | 


--------------------------------------------------------------------------------
/static/logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/punitdarji/WebMap/ff553249f2b3f62d0e414f4c7f4991a4f2a65b16/static/logo.png


--------------------------------------------------------------------------------
/static/logoblack.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/punitdarji/WebMap/ff553249f2b3f62d0e414f4c7f4991a4f2a65b16/static/logoblack.png


--------------------------------------------------------------------------------
/static/logomin.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/punitdarji/WebMap/ff553249f2b3f62d0e414f4c7f4991a4f2a65b16/static/logomin.png


--------------------------------------------------------------------------------
/static/report.css:
--------------------------------------------------------------------------------
 1 | 
 2 | body {
 3 | 	// font-weight:300;
 4 | }
 5 | 
 6 | b {
 7 | 	font-weight:600;
 8 | }
 9 | 
10 | h1 {
11 | 	font-weight:700;
12 | }
13 | 
14 | .subtitle {
15 | 	margin-top:-20px;
16 | 	color:#999;
17 | 	font-size:24px;
18 | }
19 | 
20 | .small {
21 | 	font-size:12px;
22 | 	color:#666;
23 | }
24 | 
25 | .margintb {
26 | 	margin-top:60px;
27 | 	margin-bottom:60px;
28 | }
29 | 
30 | .bleft {
31 | 	border-left:solid #999 1px;
32 | }
33 | 
34 | .extrainfo {
35 | 	border-top: solid #ccc 1px;
36 | 	padding:10px;
37 | 	margin-bottom:10px;
38 | 	font-family:monospace;
39 | }
40 | 
41 | .extratitle {
42 | 	font-size: 20px;
43 | 	margin-top: 40px;
44 | }
45 | 
46 | .label {
47 | 	padding:6px;
48 | 	border-radius:4px;
49 | 	font-size:12px;
50 | 	color:#fff;
51 | }
52 | 


--------------------------------------------------------------------------------
/templates/nmapreport/index.html:
--------------------------------------------------------------------------------
  1 | {% load static %}
  2 | <!DOCTYPE html>
  3 |   <html>
  4 |     <head>
  5 |       <link href="https://fonts.googleapis.com/icon?family=Material+Icons" rel="stylesheet">
  6 |       <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/css/materialize.min.css">
  7 |       <link rel="stylesheet" href="{% static "/custom.css" %}">
  8 | 		<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.3.1/css/all.css" integrity="sha384-mzrmE5qonljUremFsqc01SB46JvROS7bZs3IO2EmfFsd15uHvIt+Y8vEf7N7fWAU" crossorigin="anonymous">
  9 |       <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
 10 |       <script src="{% static "/async.js" %}"></script>
 11 |       <script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.7.2/Chart.js"></script>
 12 | 		<script src="https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/2.0.0/clipboard.min.js"></script>
 13 |       <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
 14 |     </head>
 15 | 
 16 |     <body>
 17 | 
 18 | 		<!-- TOP NAV -->
 19 | 		<div class="navbar-fixed">
 20 | 			<nav style="background-color:rgba(0,0,0,0.8);">
 21 | 				<div class="nav-wrapper">
 22 | 					<div class="left scantitle" id="scantitle"></div>
 23 | 					<a href="/" class="brand-logo center"><img src="/static/logo.png" style="height:28px;" /></a>
 24 | 					<ul class="right hide-on-med-and-down">
 25 | 						<li><a href="/setscanfile/unset">Scan List</a></li>
 26 | 						<li><a href="/">Scan Detail</a></li>
 27 | 					</ul>
 28 | 				</div>
 29 | 			</nav>
 30 | 		</div>
 31 |  
 32 | 
 33 | 		<div class="container" style="margin-top:60px;">
 34 | 
 35 | 			<!-- HEADER -->
 36 | 			{{ topcontainer|safe }}
 37 | 			<div class="card" style="background-color:#3e3e3e;">
 38 | 				<div class="card-content">
 39 | 					{{ scaninfo|safe }}
 40 | 				</div>
 41 | 				<div class="card-reveal" style="background-color:#3e3e3e;">
 42 | 					<span class="card-title grey-text">Scan Details<i class="material-icons right">close</i></span>
 43 | 					{{ scandetails|safe }}
 44 | 				</div>
 45 | 			</div>
 46 | 
 47 | 			<!-- PRE RESULTS TABLE -->
 48 | 			<div class="pretable"> {{ pretable|safe }} </div>
 49 | 
 50 | 			<!-- RESULTS TABLE -->
 51 | 			<div class="card" style="background-color:#3e3e3e;">
 52 | 				<div class="card-content">
 53 | 					<table class="">
 54 | 						<thead>
 55 | 							{{ trhead|safe }}
 56 | 						</thead>
 57 | 						<tbody>
 58 | 							{{ trhost|safe }}
 59 | 						</tbody>
 60 | 					</table>
 61 | 				</div>
 62 | 			</div>
 63 | 
 64 | 			{{ table|safe }}
 65 | 
 66 | 			<!-- DEBUG -->
 67 | 			<pre>
 68 | 				{{ out|safe }}
 69 | 			</pre>
 70 | 		</div>
 71 | 
 72 | 		<!-- MODAL -->
 73 | 		<div id="modal1" class="modal modal-fixed-footer">
 74 | 			<div class="modal-content">
 75 | 				<h4 id="modaltitle">un titolo</h4>
 76 | 				<p id="modalbody">del testo</p>
 77 | 			</div>
 78 | 			<div class="modal-footer" id="modalfooter" style="background-color:#3e3e3e;">
 79 | 				<a href="#!" class="modal-close waves-effect waves-green btn grey white-text">OK</a>
 80 | 			</div>
 81 | 			{% csrf_token %}
 82 | 		</div>
 83 | 
 84 | 		<script src="https://cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/js/materialize.min.js"></script>
 85 | 		<script>
 86 | 			$(document).ready(function(){
 87 | 				$('.sidenav').sidenav();
 88 | 				$('.modal').modal();
 89 | 			});
 90 | 
 91 | 			document.addEventListener('DOMContentLoaded', function() {
 92 | 				var elems = document.querySelectorAll('.fixed-action-btn');
 93 | 				var instances = M.FloatingActionButton.init(elems, {
 94 | 					direction: 'top'
 95 | 				});
 96 | 			});
 97 | 		</script>
 98 | 
 99 | 	</body>
100 | </html>
101 | 


--------------------------------------------------------------------------------
/templates/nmapreport/report.html:
--------------------------------------------------------------------------------
 1 | {% load static %}
 2 | <!DOCTYPE html>
 3 |   <html>
 4 |     <head>
 5 |       <link href="https://fonts.googleapis.com/icon?family=Material+Icons" rel="stylesheet">
 6 |       <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/css/materialize.min.css">
 7 | 		<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.3.1/css/all.css">
 8 |       <link rel="stylesheet" href="{% static "/report.css" %}">
 9 |       <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
10 |       <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
11 |     </head>
12 | 
13 |     <body>
14 | 
15 | 		{{ html|safe }}
16 | 
17 | 		<pre> {{ out|safe }}</pre>
18 | 
19 |       <script src="https://cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/js/materialize.min.js"></script>
20 |     </body>
21 |   </html>
22 | 


--------------------------------------------------------------------------------
/tests.py:
--------------------------------------------------------------------------------
1 | from django.test import TestCase
2 | 
3 | # Create your tests here.
4 | 


--------------------------------------------------------------------------------
/urls.py:
--------------------------------------------------------------------------------
 1 | from django.urls import path
 2 | from . import views, api, pdf
 3 | 
 4 | urlpatterns = [
 5 | 	path('', views.index, name='index'),
 6 | 	path('setscanfile/<scanfile>', views.setscanfile, name='setscanfile'),
 7 | 	path('<address>/', views.details, name='details'),
 8 | 	path('port/<port>/', views.port, name='port'),
 9 | 	path('service/<filterservice>/', views.index, name='service'),
10 | 	path('portid/<filterportid>/', views.index, name='portid'),
11 | 	path('api/setlabel/<objtype>/<label>/<hashstr>/', api.label, name='api_label'),
12 | 	path('api/rmlabel/<objtype>/<hashstr>/', api.rmlabel, name='api_rmlabel'),
13 | 	path('api/pdf/', api.genPDF, name='genPDF'),
14 | 	path('api/savenotes/', api.saveNotes, name='genPDF'),
15 | 	path('api/rmnotes/<hashstr>/', api.rmNotes, name='api_rmnotes'),
16 | 	path('api/<address>/<portid>/', api.port_details, name='api_port'),
17 | 	path('view/pdf/', pdf.reportPDFView, name='reportPDFView')
18 | ]
19 | 


--------------------------------------------------------------------------------
/views.py:
--------------------------------------------------------------------------------
  1 | from django.shortcuts import render
  2 | from django.http import HttpResponse
  3 | import xmltodict, json, html, os, hashlib, re, urllib.parse, base64
  4 | from collections import OrderedDict
  5 | from nmapreport.functions import *
  6 | 
  7 | def setscanfile(request, scanfile):
  8 | 	xmlfiles = os.listdir('/opt/xml')
  9 | 
 10 | 	for i in xmlfiles:
 11 | 		if i == scanfile:
 12 | 			request.session['scanfile'] = i
 13 | 			break
 14 | 
 15 | 	if scanfile == 'unset':
 16 | 		if 'scanfile' in request.session:
 17 | 			del(request.session['scanfile'])
 18 | 
 19 | 	return render(request, 'nmapreport/index.html', { 'out': '', 'table': '', 'scaninfo': '<script> location.href="/"; </script>', 'scandetails': '', 'trhost': '' })
 20 | 
 21 | 
 22 | def port(request, port):
 23 | 	return render(request, 'nmapreport/index.html', { 'out': '', 'table': '', 'scaninfo': '', 'scandetails': '', 'trhost': '' })
 24 | 
 25 | def details(request, address):
 26 | 	r = {}
 27 | 	oo = xmltodict.parse(open('/opt/xml/'+request.session['scanfile'], 'r').read())
 28 | 	r['out2'] = json.dumps(oo['nmaprun'], indent=4)
 29 | 	o = json.loads(r['out2'])
 30 | 
 31 | 	r['trhost'] = ''
 32 | 	v,e,z,h = '','','',''
 33 | 	pc,po,pf=0,0,0
 34 | 
 35 | 	scanmd5 = hashlib.md5(str(request.session['scanfile']).encode('utf-8')).hexdigest()
 36 | 	addressmd5 = hashlib.md5(str(address).encode('utf-8')).hexdigest()
 37 | 
 38 | 	# collect all labels in labelhost dict
 39 | 	labelhost = {}
 40 | 	labelfiles = os.listdir('/opt/notes')
 41 | 	for lf in labelfiles:
 42 | 		m = re.match('^('+scanmd5+')_([a-z0-9]{32,32})\.host\.label$', lf)
 43 | 		if m is not None:
 44 | 			if m.group(1) not in labelhost:
 45 | 				labelhost[m.group(1)] = {}
 46 | 			labelhost[m.group(1)][m.group(2)] = open('/opt/notes/'+lf, 'r').read()
 47 | 
 48 | 	# collect all notes in noteshost dict
 49 | 	noteshost = {}
 50 | 	notesfiles = os.listdir('/opt/notes')
 51 | 	for nf in notesfiles:
 52 | 		m = re.match('^('+scanmd5+')_([a-z0-9]{32,32})\.notes$', nf)
 53 | 		if m is not None:
 54 | 			if m.group(1) not in noteshost:
 55 | 				noteshost[m.group(1)] = {}
 56 | 			noteshost[m.group(1)][m.group(2)] = open('/opt/notes/'+nf, 'r').read()
 57 | 
 58 | 
 59 | 	r['trhead'] = '<tr><th>Port</th><th style="width:300px;">Product / Version</th><th>Extra Info</th><th>&nbsp;</th></tr>'
 60 | 	pel=0
 61 | 	for ik in o['host']:
 62 | 		# this fix single host report
 63 | 		if type(ik) is dict:
 64 | 			i = ik
 65 | 		else:
 66 | 			i = o['host']
 67 | 
 68 | 		if '@addr' in i['address']:
 69 | 			saddress = i['address']['@addr']
 70 | 		elif type(i['address']) is list:
 71 | 			for ai in i['address']:
 72 | 				if ai['@addrtype'] == 'ipv4':
 73 | 					saddress = ai['@addr'] 
 74 | 
 75 | 
 76 | 		if str(saddress) == address:
 77 | 			#r['out'] = json.dumps(i, indent=4)
 78 | 			h = '<span style="color:#999;font-size:12px;"><i>No Hostname</i></span>'
 79 | 			if 'hostnames' in i:
 80 | 				if type(i['hostnames']) is dict and 'hostname' in i['hostnames']:
 81 | 					if '@name' in i['hostnames']['hostname']:
 82 | 						h = '<span style="color:#999;font-size:12px;">'+i['hostnames']['hostname']['@name']+'</span>'
 83 | 
 84 | 			labelout = '<span id="hostlabel"></span>'
 85 | 			if scanmd5 in labelhost:
 86 | 				if addressmd5 in labelhost[scanmd5]:
 87 | 					labelcolor = labelToColor(labelhost[scanmd5][addressmd5])
 88 | 					labelmargin = labelToMargin(labelhost[scanmd5][addressmd5])
 89 | 					labelout = '<span id="hostlabel" style="margin-left:60px;margin-top:-24px;" class="rightlabel '+labelcolor+'">'+html.escape(labelhost[scanmd5][addressmd5])+'</span>'
 90 | 
 91 | 			r['scaninfo'] = '<div class="row">'+\
 92 | 			'	<div class="col s3"><span class="card-title">Host Details:</span><h6>'+html.escape(address)+'</h6>'+h+labelout+'</div>'+\
 93 | 			'	<div class="col s3" id="detailspo"></div>'+\
 94 | 			'	<div class="col s3" id="detailspc"></div>'+\
 95 | 			'	<div class="col s3" id="detailspf"></div>'+\
 96 | 			'</div>'
 97 | 
 98 | 			rmdupl = {}
 99 | 			for pobj in i['ports']['port']:
100 | 				if type(pobj) is dict:
101 | 					p = pobj
102 | 				else:
103 | 					p = i['ports']['port']
104 | 
105 | 				if p['@portid'] in rmdupl:
106 | 					continue
107 | 
108 | 				rmdupl[p['@portid']] = 1
109 | 
110 | 				if p['state']['@state'] == 'closed':
111 | 					pc = (pc + 1)
112 | 				elif p['state']['@state'] == 'open':
113 | 					po = (po + 1)
114 | 				elif p['state']['@state'] == 'filtered':
115 | 					pf = (pf + 1)
116 | 
117 | 				pel = (pel + 1)
118 | 				oshtml = ''
119 | 				if '@ostype' in p['service']:
120 | 					oshtml = '<div style="font-family:monospace;padding:6px;margin:6px;border-left:solid #666 1px;"><sup style="border-bottom:solid #ccc 1px;">Operating System</sup><br>'+html.escape(p['service']['@ostype'])+'</div>'
121 | 
122 | 				so = ''
123 | 				if 'script' in p:
124 | 					if '@id' in p['script']:
125 | 						if p['script']['@id'] != 'fingerprint-strings':
126 | 							so += '<div style="word-wrap: break-word;word-break: break-all;padding:6px;margin-left:6px;border-left:solid #666 1px;max-width:300px;font-size:12px;color:#ccc;font-family:monospace;"><sup style="color:#999;border-bottom:solid #999 1px;">script output</sup><br><b>'+html.escape(p['script']['@id'])+'</b> '+html.escape(p['script']['@output'])+'</div>'
127 | 					else:
128 | 						for sosc in p['script']:
129 | 							if '@id' in sosc:
130 | 								if sosc['@id'] != 'fingerprint-strings':
131 | 									so += '<div style="word-wrap: break-word;word-break: break-all;padding:6px;margin:6px;border-left:solid #666 1px;max-width:300px;font-size:12px;color:#ccc;font-family:monospace;"><sup style="color:#999;border-bottom:solid #999 1px;">script output</sup><br><b>'+html.escape(sosc['@id'])+'</b> '+html.escape(sosc['@output'])+'</div>'
132 | 
133 | 				v,z,e = '','','<i class="grey-text">N/A</i>'
134 | 				if p['state']['@state'] == 'open':
135 | 					if '@version' in p['service']:
136 | 						v = p['service']['@version']
137 | 					else:
138 | 						v = '<i class="grey-text">No Version</i>'
139 | 
140 | 					if '@product' in p['service']:
141 | 						z = p['service']['@product']
142 | 					else:
143 | 						z = '<i class="grey-text">No Product</i>'
144 | 
145 | 					if '@extrainfo' in p['service']:
146 | 						e = p['service']['@extrainfo']
147 | 
148 | 					cpe = ''
149 | 					if 'cpe' in p['service']:
150 | 						if type(p['service']['cpe']) is list:
151 | 							for cpei in p['service']['cpe']:
152 | 								cpe += '<span class="grey-text" style="font-family:monospace;font-size:12px;">'+html.escape(cpei)+'</span><br>'
153 | 						else:
154 | 								cpe = '<span class="grey-text" style="font-family:monospace;font-size:12px;">'+html.escape(p['service']['cpe'])+'</span><br>'
155 | 							
156 | 
157 | 					r['trhost'] += '<tr><td style="vertical-align:top;">'+\
158 | 					'<span style="color:#999;font-size:12px;">'+p['service']['@name']+'</span><br>'+\
159 | 					'<span class="new badge blue" data-badge-caption="">'+p['@protocol']+' / '+p['@portid']+'</span>'+\
160 | 					'</td>'+\
161 | 					'<td>'+z+' / '+v+'<br><span style="font-size:12px;color:#999;">State: '+p['state']['@state']+'<br>Reason: '+p['state']['@reason']+'</span></td>'+\
162 | 					'<td style="vertical-align:top">'+e+'<br>'+cpe+'</td>'+\
163 | 					'<td><ul id="dropdown'+str(pel)+'" class="dropdown-content" style="min-width:300px;">'+\
164 | 					'	<li><a href="#!" class="btncpy" data-clipboard-text="curl -v -A \'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1\' -k \'http://'+html.escape(address)+':'+html.escape(p['@portid'])+'\'">Copy as curl command</a></li>'+\
165 | 					'	<li><a href="#!" class="btncpy" data-clipboard-text="nikto -host \'http://'+html.escape(address)+':'+html.escape(p['@portid'])+'\'">Copy as nikto command</a></li>'+\
166 | 					'	<li><a href="#!" class="btncpy" data-clipboard-text="telnet '+html.escape(address)+' '+html.escape(p['@portid'])+'">Copy as telnet command</a></li>'+\
167 | 					'</ul><a class="dropdown-trigger btn blue right" href="#!" data-target="dropdown'+str(pel)+'"><i class="material-icons">arrow_drop_down</i></a> '+\
168 | 					'<button onclick="javascript:apiPortDetails(\''+html.escape(address)+'\',\''+html.escape(p['@portid'])+'\');" class="btn blue right"><i class="material-icons">receipt</i></button></td>'+\
169 | 					'</tr>'
170 | 				elif p['state']['@state'] == 'filtered':
171 | 					r['trhost'] += '<tr><td><span class="new badge grey" data-badge-caption="">'+p['@protocol']+' / '+p['@portid']+'</span><br>'+\
172 | 					'<span style="color:#999;font-size:12px;">'+p['service']['@name']+'</span></td>'+\
173 | 					'<td colspan="2" style="color:#999;font-size:12px;">State: filtered<br>Reason: '+p['state']['@reason']+'</td>'+\
174 | 					'<td><button onclick="javascript:apiPortDetails(\''+html.escape(address)+'\',\''+html.escape(p['@portid'])+'\');" class="btn blue right"><i class="material-icons">receipt</i></button></td></tr>'
175 | 				else:
176 | 					r['trhost'] += '<tr><td><span class="new badge grey" data-badge-caption="">'+p['@protocol']+' / '+p['@portid']+'</span><br>'+\
177 | 					'<span style="color:#999;font-size:12px;">'+p['service']['@name']+'</span></td>'+\
178 | 					'<td colspan="2" style="color:#999;font-size:12px;">State: '+p['state']['@state']+'<br>Reason: '+p['state']['@reason']+'</td>'+\
179 | 					'<td><button onclick="javascript:apiPortDetails(\''+html.escape(address)+'\',\''+html.escape(p['@portid'])+'\');" class="btn blue right"><i class="material-icons">receipt</i></button></td></tr>'
180 | 
181 | 		# this fix single host report
182 | 		if type(ik) is not dict:
183 | 			break;
184 | 
185 | 	notesout,notesb64,removenotes = '','',''
186 | 	if scanmd5 in noteshost:
187 | 		if addressmd5 in noteshost[scanmd5]:
188 | 			notesb64 = noteshost[scanmd5][addressmd5]
189 | 			r['table'] = '<div class="card" style="background-color:#3e3e3e;">'+\
190 | 			'	<div class="card-content"><h5>Notes</h5>'+\
191 | 			'		'+base64.b64decode(urllib.parse.unquote(notesb64)).decode('ascii')+\
192 | 			'	</div>'+\
193 | 			'</div>'
194 | 
195 | 			#notesout = '<br><a id="noteshost'+str(hostindex)+'" href="#!" onclick="javascript:openNotes(\''+hashlib.md5(str(address).encode('utf-8')).hexdigest()+'\', \''+notesb64+'\');" class="small"><i class="fas fa-comment"></i> contains notes</a>'
196 | 			#removenotes = '<li><a href="#!" onclick="javascript:removeNotes(\''+addressmd5+'\', \''+str(hostindex)+'\');">Remove notes</a></li>'
197 | 
198 | 
199 | 
200 | 
201 | 	r['pretable'] = '<script> '+\
202 | 	'$(document).ready(function() { '+\
203 | 	'	$("#scantitle").html("'+html.escape(request.session['scanfile'])+'");'+\
204 | 	'	var clipboard = new ClipboardJS(".btncpy"); '+\
205 | 	'	clipboard.on("success", function(e) { '+\
206 | 	'		M.toast({html: "Copied to clipboard"}); '+\
207 | 	'	}); '+\
208 | 	'	$(".dropdown-trigger").dropdown(); '+\
209 | 	'	$("#detailspo").html(\'<center><h4><i class="fas fa-door-open green-text"></i> '+str(po)+'</h4><span class="small grey-text">OPEN PORTS</span></center>\');'+\
210 | 	'	$("#detailspc").html(\'<center><h4><i class="fas fa-door-closed red-text"></i> '+str(pc)+'</h4><span class="small grey-text">CLOSED PORTS</span></center>\');'+\
211 | 	'	$("#detailspf").html(\'<center><h4><i class="fas fa-filter grey-text"></i> '+str(pf)+'</h4><span class="small grey-text">FILTERED PORTS</span></center>\');'+\
212 | 	'}); '+\
213 | 	'</script>'
214 | 
215 | 	return render(request, 'nmapreport/index.html', r)
216 | 
217 | def index(request, filterservice="", filterportid=""):
218 | 	r = {}
219 | 
220 | 	if 'scanfile' in request.session:
221 | 		oo = xmltodict.parse(open('/opt/xml/'+request.session['scanfile'], 'r').read())
222 | 		r['out2'] = json.dumps(oo['nmaprun'], indent=4)
223 | 		o = json.loads(r['out2'])
224 | 	else:
225 | 		# no file selected
226 | 		xmlfiles = os.listdir('/opt/xml')
227 | 
228 | 
229 | 		r['table'] = '<div class="" style="border-top:solid #444 1px;"><br>'+\
230 | 		'		Put your Nmap XML files in <span class="tmlabel grey-text" style="background-color:transparent;">/opt/xml/</span> directory, example:<br><br>'+\
231 | 		'		<div class="tmlabel black grey-text" style="padding:10px;font-size:14px;">nmap -A -T4 -oX myscan.xml 192.168.1.0/24<br>'+\
232 | 		'		mv myscan.xml &lt;docker webmap xml dir&gt;<br><br>'+\
233 | 		'		# or you can copy myscan.xml to the webmap container:<br>'+\
234 | 		'		docker cp myscan.xml webmap:/opt/xml/</div>'+\
235 | 		'</div>'+\
236 | 		'<script async defer src="https://buttons.github.io/buttons.js"></script>'
237 | 
238 | 		r['table'] += '<div class="row" style="margin-top:60px;">'+\
239 | 		'	<div class="col s4" style="text-align:center;">'+\
240 | 		'		<img src="/static/logo.png" style="width:300px;" /><br>'+\
241 | 		'		<span style="color:#999;">Made with <i class="fas fa-heart red-text"></i> by Andrea <b><a href="https://twitter.com/Menin_TheMiddle">theMiddle</a></b> Menin</span>'+\
242 | 		'	</div>'+\
243 | 		'	<div class="col s3" style="color:#999;"><b>GitHub:</b><br><br>'+\
244 | 		'		<a class="github-button" href="https://github.com/theMiddleBlue" data-size="large" data-show-count="true" aria-label="Follow theMiddle on GitHub">Follow theMiddle</a><br>'+\
245 | 		'		<a class="github-button" href="https://github.com/Rev3rseSecurity/WebMap/subscription" data-icon="octicon-eye" data-size="large" data-show-count="true" aria-label="Watch Rev3rseSecurity/WebMap on GitHub">Watch</a><br>'+\
246 | 		'		<a class="github-button" href="https://github.com/Rev3rseSecurity/WebMap/" data-icon="octicon-star" data-size="large" data-show-count="true" aria-label="Star Rev3rseSecurity/WebMap on GitHub">Star</a>'+\
247 | 		'	</div>'+\
248 | 		'	<div class="col s5" style="color:#999;"><b>Follow me:</b><br><br>'+\
249 | 		'		<a href="https://twitter.com/Menin_TheMiddle?ref_src=twsrc%5Etfw" class="twitter-follow-button" data-size="large" data-show-count="true">Follow @Menin_TheMiddle</a><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script><br>'+\
250 | 		'		<script src="https://apis.google.com/js/platform.js"></script><div class="g-ytsubscribe" data-channelid="UCzvJStjySZVvOBsPl-Vgj0g" data-layout="default" data-theme="dark" data-count="default"></div>'+\
251 | 		'	</div>'+\
252 | 		'</div>'
253 | 
254 | 
255 | 		r['scaninfo'] = '<span class="card-title">Select a Nmap XML file</span><p>Nmap XML files: '+ str(len(xmlfiles)) +'</p>'
256 | 
257 | 		r['trhost'] = ''
258 | 		r['trhead'] = '<tr><th>Filename</th><th>Scan Start Time</th><th>Hosts</th><th>&nbsp;</th></tr>'
259 | 
260 | 		for i in xmlfiles:
261 | 			oo = xmltodict.parse(open('/opt/xml/'+i, 'r').read())
262 | 			r['out2'] = json.dumps(oo['nmaprun'], indent=4)
263 | 			o = json.loads(r['out2'])
264 | 
265 | 			if type(o['host']) is not dict:
266 | 				hostnum = str(len(o['host']))
267 | 			else:
268 | 				hostnum = '1'
269 | 
270 | 			r['trhost'] += '<tr>'+\
271 | 			'	<td style="font-family:monospace">'+html.escape(i)+'</td>'+\
272 | 			'	<td>'+html.escape(o['@startstr'])+'</td>'+\
273 | 			'	<td>'+hostnum+'</td>'+\
274 | 			'	<td><a href="/setscanfile/'+html.escape(i)+'" class="btn blue right">view</a></td>'+\
275 | 			'</tr>'
276 | 
277 | 		# r['out'] = os.listdir('/opt/xml')
278 | 		return render(request, 'nmapreport/index.html', r)
279 | 
280 | 	scanmd5 = hashlib.md5(str(request.session['scanfile']).encode('utf-8')).hexdigest()
281 | 
282 | 	r['topcontainer'] = '<div class="fixed-action-btn">'+\
283 | 	'	<a class="btn-floating btn-large red">'+\
284 | 	'		<i class="large material-icons">mode_edit</i>'+\
285 | 	'	</a>'+\
286 | 	'	<ul>'+\
287 | 	'		<li><a class="btn-floating red tooltipped" data-position="left" data-tooltip="PDF Report" onclick="javascript:genPDF(\''+scanmd5+'\');"><i class="material-icons">insert_chart</i></a></li>'+\
288 | 	'		<li><a class="btn-floating blue darken-1 tooltipped" data-position="left" data-tooltip="Hide/Show hosts with no open ports" onclick="javascript:$(\'.zeroportopen\').fadeToggle();"><i class="material-icons">view_day</i></a></li>'+\
289 | 	'	</ul>'+\
290 | 	'</div>'
291 | 
292 | 	# collect all labels in labelhost dict
293 | 	labelhost = {}
294 | 	labelfiles = os.listdir('/opt/notes')
295 | 	for lf in labelfiles:
296 | 		m = re.match('^('+scanmd5+')_([a-z0-9]{32,32})\.host\.label$', lf)
297 | 		if m is not None:
298 | 			if m.group(1) not in labelhost:
299 | 				labelhost[m.group(1)] = {}
300 | 			labelhost[m.group(1)][m.group(2)] = open('/opt/notes/'+lf, 'r').read()
301 | 
302 | 	# collect all notes in noteshost dict
303 | 	noteshost = {}
304 | 	notesfiles = os.listdir('/opt/notes')
305 | 	for nf in notesfiles:
306 | 		m = re.match('^('+scanmd5+')_([a-z0-9]{32,32})\.notes$', nf)
307 | 		if m is not None:
308 | 			if m.group(1) not in noteshost:
309 | 				noteshost[m.group(1)] = {}
310 | 			noteshost[m.group(1)][m.group(2)] = open('/opt/notes/'+nf, 'r').read()
311 | 
312 | 	tableout = ''
313 | 	hostsup = 0
314 | 	ports = { 'open': 0, 'closed': 0, 'filtered': 0 }
315 | 	allostypelist = {}
316 | 	sscount = {}
317 | 	picount = {}
318 | 	hostindex = 1
319 | 
320 | 	r['trhost'] = ''
321 | 	r['trhead'] = '<tr><th width="260">Host</th><th>Port State</th><th width="160" style="text-align:center;">Tot Ports</th><th width="200">Services</th><th width="200">Ports</th><th>&nbsp;</th></tr>'
322 | 
323 | 	for ik in o['host']:
324 | 
325 | 		# this fix single host report
326 | 		if type(ik) is dict:
327 | 			i = ik
328 | 		else:
329 | 			i = o['host']
330 | 
331 | 		hostname = ''
332 | 
333 | 		if 'hostnames' in i and type(i['hostnames']) is dict:
334 | 			hostname += '<br><span style="color:#999;font-size:10px;">'+str(i['hostnames']['hostname']['@name'])+'</span>'
335 | 
336 | 		if i['status']['@state'] == 'up':
337 | 			hostsup = (hostsup + 1)
338 | 
339 | 		po,pc,pf = 0,0,0
340 | 		ss,pp,ost = {},{},{}
341 | 		lastportid = 0
342 | 
343 | 		striggered = False
344 | 		if 'ports' in i and 'port' in i['ports']:
345 | 			for pobj in i['ports']['port']:
346 | 				if type(pobj) is dict:
347 | 					p = pobj
348 | 				else:
349 | 					p = i['ports']['port']
350 | 
351 | 				if lastportid == p['@portid']:
352 | 					continue
353 | 				else:
354 | 					lastportid = p['@portid']
355 | 
356 | 				if filterservice != "" and p['service']['@name'] == filterservice:
357 | 					striggered = True
358 | 
359 | 				if filterportid != "" and p['@portid'] == filterportid:
360 | 					striggered = True
361 | 
362 | 				ss[p['service']['@name']] = p['service']['@name']
363 | 				pp[p['@portid']] = p['@portid']
364 | 
365 | 				if '@ostype' in p['service']:
366 | 					if p['service']['@ostype'] in allostypelist:
367 | 						allostypelist[p['service']['@ostype']] = (allostypelist[p['service']['@ostype']] +1)
368 | 					else:
369 | 						allostypelist[p['service']['@ostype']] = 1;
370 | 
371 | 					ost[p['service']['@ostype']] = p['service']['@ostype']
372 | 
373 | 				if p['service']['@name'] in sscount:
374 | 					sscount[p['service']['@name']] = (sscount[p['service']['@name']] + 1)
375 | 				else:
376 | 					sscount[p['service']['@name']] = 1
377 | 
378 | 				if p['@portid'] in picount:
379 | 					picount[p['@portid']] = (picount[p['@portid']] + 1)
380 | 				else:
381 | 					picount[p['@portid']] = 1
382 | 
383 | 					
384 | 				if p['state']['@state'] == 'closed':
385 | 					ports['closed'] = (ports['closed'] + 1)
386 | 					pc = (pc + 1)
387 | 				elif p['state']['@state'] == 'open':
388 | 					ports['open'] = (ports['open'] + 1)
389 | 					po = (po + 1)
390 | 				elif p['state']['@state'] == 'filtered':
391 | 					ports['filtered'] = (ports['filtered'] + 1)
392 | 					pf = (pf + 1)
393 | 
394 | 			services = ''
395 | 			for s in ss:
396 | 				if filterservice != ss[s]:
397 | 					services += '<a href="/report/service/'+ss[s]+'/">'+ss[s]+'</a>, '
398 | 				else:
399 | 					services += '<span class="tmlabel" style="background-color:#ffcc00;color:#333;">'+ss[s]+'</span>, '
400 | 
401 | 			ostype = ''
402 | 			for oty in ost:
403 | 				ostype += '<i class="'+fromOSTypeToFontAwesome(html.escape(ost[oty]))+'"></i> <span class="grey-text small">'+ost[oty].lower()+'</span> '
404 | 
405 | 			tdports = ''
406 | 			for kp in pp:
407 | 				if filterportid != pp[kp]:
408 | 					tdports += '<a href="/report/portid/'+pp[kp]+'/">'+pp[kp]+'</a>, '
409 | 				else:
410 | 					tdports += '<span class="tmlabel" style="background-color:#ffcc00;color:#333;">'+pp[kp]+'</span>, '
411 | 
412 | 			poclass = ''
413 | 			if po == 0:
414 | 				poclass = 'zeroportopen'
415 | 
416 | 			if '@addr' in i['address']:
417 | 				address = i['address']['@addr']
418 | 			elif type(i['address']) is list:
419 | 				for ai in i['address']:
420 | 					if ai['@addrtype'] == 'ipv4':
421 | 						address = ai['@addr'] 
422 | 
423 | 			addressmd5 = hashlib.md5(str(address).encode('utf-8')).hexdigest()
424 | 			labelout = '<span id="hostlabel'+str(hostindex)+'"></span>'
425 | 			if scanmd5 in labelhost:
426 | 				if addressmd5 in labelhost[scanmd5]:
427 | 					labelcolor = labelToColor(labelhost[scanmd5][addressmd5])
428 | 					labelmargin = labelToMargin(labelhost[scanmd5][addressmd5])
429 | 					labelout = '<span id="hostlabel'+str(hostindex)+'" style="margin-left:'+labelmargin+'" class="rightlabel '+labelcolor+'">'+html.escape(labelhost[scanmd5][addressmd5])+'</span>'
430 | 
431 | 			notesout,notesb64,removenotes = '','',''
432 | 			if scanmd5 in noteshost:
433 | 				if addressmd5 in noteshost[scanmd5]:
434 | 					notesb64 = noteshost[scanmd5][addressmd5]
435 | 					notesout = '<br><a id="noteshost'+str(hostindex)+'" href="#!" onclick="javascript:openNotes(\''+hashlib.md5(str(address).encode('utf-8')).hexdigest()+'\', \''+notesb64+'\');" class="small"><i class="fas fa-comment"></i> contains notes</a>'
436 | 					removenotes = '<li><a href="#!" onclick="javascript:removeNotes(\''+addressmd5+'\', \''+str(hostindex)+'\');">Remove notes</a></li>'
437 | 
438 | 			if (filterservice != "" and striggered is True) or (filterportid != "" and striggered is True) or (filterservice == "" and filterportid == ""):
439 | 				portstateout = '<td style="font-size:10px;color:#999;width:300px;"><div style="overflow:none;background-color:#666;" class="tooltipped" data-position="top" data-tooltip="'+str(po)+' open, '+str(pc)+' closed, '+str(pf)+' filtered">'+\
440 | 				'		<div class="perco" data-po="'+str(po)+'" style="padding-left:16px;padding-right:20px;">'+str(po)+'</div>'+\
441 | 				' </div></td>'
442 | 
443 | 				if (filterservice != "" and striggered is True):
444 | 					portstateout = '<td style="font-size:10px;color:#999;width:300px;"><div style="overflow:none;background-color:#666;" class="tooltipped" data-position="top" data-tooltip="'+str(po)+' open, '+str(pc)+' closed, '+str(pf)+' filtered">'+\
445 | 					'		<div class="perco" data-po="'+str(po)+'" data-pt="'+str((po + pf + pc))+'" style="padding-left:16px;padding-right:20px;">'+str(po)+'</div>'+\
446 | 					'	</div></td>'
447 | 
448 | 				r['trhost'] += '<tr class="'+poclass+'">'+\
449 | 				'	<td><span class="leftlabel" style="background-color:#4a4a4a;color:#999;">'+str(hostindex)+'</span>'+\
450 | 				'		'+ostype+'<br>'+\
451 | 				'		<b><a href="/report/'+str(address)+'">'+str(address)+'</a></b>'+hostname+''+\
452 | 				notesout+\
453 | 				'	</td>'+\
454 | 				portstateout+\
455 | 				'	<td style="font-family:monospace;text-align:center;">'+str((po + pf + pc))+'</td>'+\
456 | 				'	<td style="font-size:12px;">'+str(services[0:-2])+'</td>'+\
457 | 				'	<td style="font-size:12px;">'+str(tdports[0:-2])+'</td>'+\
458 | 				'	<td>'+\
459 | 				'		<ul id="hostdd'+str(hostindex)+'" class="dropdown-content" style="min-width:200px;">'+\
460 | 				'			<li><a href="#!" onclick="javascript:setLabel(\'host\', \'Vulnerable\', \''+hashlib.md5(str(address).encode('utf-8')).hexdigest()+'\', '+str(hostindex)+');"><span class="tmlabel red">Vulnerable</span></a></li>'+\
461 | 				'			<li><a href="#!" onclick="javascript:setLabel(\'host\', \'Critical\', \''+hashlib.md5(str(address).encode('utf-8')).hexdigest()+'\', '+str(hostindex)+');"><span class="tmlabel black">Critical</span></a></li>'+\
462 | 				'			<li><a href="#!" onclick="javascript:setLabel(\'host\', \'Warning\', \''+hashlib.md5(str(address).encode('utf-8')).hexdigest()+'\', '+str(hostindex)+');"><span class="tmlabel orange"><span class="tmlabel orange">Warning</span></a></li>'+\
463 | 				'			<li><a href="#!" onclick="javascript:setLabel(\'host\', \'Checked\', \''+hashlib.md5(str(address).encode('utf-8')).hexdigest()+'\', '+str(hostindex)+');"><span class="tmlabel blue"><span class="tmlabel blue">Checked</span></a></li>'+\
464 | 				'			<li><a href="#!" onclick="javascript:removeLabel(\'host\', \''+addressmd5+'\', '+str(hostindex)+');">Remove label</a></li>'+\
465 | 				'			<li class="divider"></li>'+\
466 | 				'			<li><a href="#!" onclick="javascript:openNotes(\''+hashlib.md5(str(address).encode('utf-8')).hexdigest()+'\', \''+notesb64+'\');">Insert notes</a></li>'+\
467 | 				'			'+removenotes+\
468 | 				'		</ul>'+\
469 | 				labelout+\
470 | 				'		<button class="btn darken-2 grey right dropdown-trigger" data-target="hostdd'+str(hostindex)+'"><i class="material-icons">arrow_drop_down</i></button>'+\
471 | 				'	</td>'+\
472 | 				'</tr>'
473 | 				hostindex = (hostindex + 1)
474 | 
475 | 				# this fix single host report
476 | 				if type(ik) is not dict:
477 | 					break;
478 | 
479 | 	totports = (ports['open']+ports['closed']+ports['filtered'])
480 | 	if filterservice == "" and filterportid == "":
481 | 		scaninfobox2 = '<canvas id="chart1"></canvas>'
482 | 		scaninfobox3 = '<canvas id="chart3" height="150"></canvas>'
483 | 	else:
484 | 		scaninfobox2 = ''+\
485 | 		'	Filter port / service: <b>'+html.escape(filterportid+filterservice)+'</b> <a href="/"><i class="fas fa-trash-alt"></i></a><br>'+\
486 | 		'	Total Ports: '+str(totports)+'<br>'+\
487 | 		'	Open Ports: '+str(ports['open'])+'<br>'+\
488 | 		'	Closed Ports: '+str(ports['closed'])+'<br>'+\
489 | 		'	Filtered Ports: '+str(ports['filtered'])+'<br>'
490 | 		scaninfobox3 = '<div id="detailstopports"></div>'
491 | 
492 | 	r['scaninfo'] = ''+\
493 | 	'<div class="row">'+\
494 | 	'	<div class="col s4">Scan Information</div>'+\
495 | 	'	<div class="col s4">Ports Status</div>'+\
496 | 	'	<div class="col s4">Top Ports / Services</div>'+\
497 | 	'</div>'+\
498 | 	'<div class="row">'+\
499 | 	'	<div class="col s4">'+\
500 | 	'		<b class="orange-text">Start:</b> '+o['@startstr']+'<br>'+\
501 | 	'		<b class="orange-text">Scan Type:</b> '+o['scaninfo']['@type']+'<br>'+\
502 | 	'		<b class="orange-text">Scan Protocol:</b> '+o['scaninfo']['@protocol']+'<br>'+\
503 | 	'		<b class="orange-text">Nmap Command:</b> <a class="activator" href="#!">view details</a>'+\
504 | 	'	</div>'+\
505 | 	'	<div class="col s4" style="border-left:solid #999 1px;">'+\
506 | 	scaninfobox2+\
507 | 	'	</div>'+\
508 | 	'	<div class="col s4" style="border-left:solid #999 1px;">'+\
509 | 	scaninfobox3+\
510 | 	'	</div>'+\
511 | 	'</div>'
512 | 
513 | 	r['scandetails'] = '<div class="code" style="word-wrap: break-word;overflow-wrap: break-word;">'+\
514 | 	'	<p>'+o['@args']+'</p>'+\
515 | 	'	<p>'+\
516 | 	'		version: '+o['@version']+'<br>'+\
517 | 	'		xmloutputversion: '+o['@xmloutputversion']+'<br>'+\
518 | 	'	</p>'+\
519 | 	'</div>'
520 | 		
521 | 
522 | 	allss = ''
523 | 	allsslabels = ''
524 | 	allssdata = ''
525 | 	for i in sorted(sscount, key=sscount.__getitem__, reverse=True):
526 | 		if filterservice != i:
527 | 			allss += '<a href="/report/service/'+html.escape(i)+'/">'+html.escape(i)+'('+str(sscount[i])+')</a>, '
528 | 		else:
529 | 			allss += '<span class="tmlabel" style="background-color:#ffcc00;color:#333;">'+html.escape(i)+'</span>, '
530 | 
531 | 		allsslabels += '"'+html.escape(i)+'", '
532 | 		allssdata += ''+str(sscount[i])+','
533 | 
534 | 	allpilabels = ''
535 | 	allpidata = ''
536 | 	allpilinks = ''
537 | 	allpic = 1
538 | 	for i in sorted(picount, key=picount.__getitem__, reverse=True):
539 | 		allpilinks += '<a href="/report/portid/'+str(i)+'/">'+str(i)+'</a>, '
540 | 		if allpic <= 5:
541 | 			allpilabels += '"'+html.escape(i)+'", '
542 | 			allpidata += ''+str(picount[i])+','
543 | 			allpic = (allpic + 1)
544 | 
545 | 	allostypelinks = ''
546 | 	for i in sorted(allostypelist, key=allostypelist.__getitem__, reverse=True):
547 | 		allostypelinks += '<a href="">'+str(i)+'</a>, '
548 | 
549 | 
550 | 	r['pretable'] = ''
551 | 	if filterservice == "" and filterportid == "":
552 | 		r['pretable'] += '<div class="row">'+\
553 | 		'	<div class="col s3" style="padding:1px;"><div class="card" style="text-align:center;padding:6px;background-color:#3e3e3e;"><h4><i class="fab fa-creative-commons-sampling"></i> <span class="blue-text">'+str(hostsup)+'</span></h4><span class="small grey-text">HOSTS UP</span></div></div>'+\
554 | 		'	<div class="col s3" style="padding:1px;"><div class="card" style="text-align:center;padding:6px;background-color:#3e3e3e;"><h4><i class="fas fa-door-open"></i> <span class="green-text">'+str(ports['open'])+'</span></h4><span class="small grey-text">OPEN PORTS</span></div></div>'+\
555 | 		'	<div class="col s3" style="padding:1px;"><div class="card" style="text-align:center;padding:6px;background-color:#3e3e3e;"><h4><i class="fas fa-door-closed"></i> <span class="red-text">'+str(ports['closed'])+'</span></h4><span class="small grey-text">CLOSED PORTS</span></div></div>'+\
556 | 		'	<div class="col s3" style="padding:1px;"><div class="card" style="text-align:center;padding:6px;background-color:#3e3e3e;"><h4><i class="fas fa-filter"></i> <span class="orange-text">'+str(ports['filtered'])+'</span></h4><span class="small grey-text">FILTERED PORTS</span></div></div>'+\
557 | 		'</div>'+\
558 | 		'<div class="card" style="background-color:#3e3e3e;">'+\
559 | 		'	<div class="card-content">'+\
560 | 		'		<div class="row">'+\
561 | 		'			<div class="col s4"><b>Services:</b></div><div class="col s8"><b>Services:</b></div>'+\
562 | 		'			<div class="col s4" style="border-right:solid #999 1px;margin-top:10px;min-height:410px;">'+\
563 | 		'				<span style="font-family:monospace;font-size:12px;">'+allss[0:-2]+'</span><br><br>'+\
564 | 		'				<b>Top 10 Ports:</b><br><span style="font-family:monospace;font-size:12px;">'+allpilinks[0:-2]+'</span><br><br>'+\
565 | 		'				<b>OS Type List:</b><br><span style="font-family:monospace;font-size:12px;">'+allostypelinks[0:-2]+'</span>'+\
566 | 		'			</div>'+\
567 | 		'			<div class="col s8" style="margin-top:10px;"><canvas id="chart2" height="200"></canvas></div>'+\
568 | 		'		</div>'+\
569 | 		'	</div>'+\
570 | 		'</div>'
571 | 
572 | 		r['pretable'] += '<script>'+\
573 | 		'	$(document).ready(function() {'+\
574 | 		'		var ctx = document.getElementById("chart1").getContext("2d");'+\
575 | 		'		var myChart = new Chart(ctx, {'+\
576 | 		'			type: "doughnut", data: {labels:["Open", "Filtered", "Closed"], datasets: [{ data: ['+str(ports['open'])+','+str(ports['filtered'])+','+str(ports['closed'])+'], backgroundColor:["rgba(0,200,0,0.8)","rgba(255,200,0,0.8)","rgba(255,0,0,0.8)"], borderColor:"#3e3e3e" }]}, options: {legend: { position: "right", labels: { fontColor: "#cccccc" }  }}'+\
577 | 		'		});'+\
578 | 		'		var ctx = document.getElementById("chart3").getContext("2d");'+\
579 | 		'		var myChart = new Chart(ctx, {'+\
580 | 		'			type: "doughnut", data: {labels:['+allpilabels[0:-2]+'], datasets: [{ data: ['+allpidata[0:-1]+'], borderColor: "#3e3e3e",  backgroundColor:["#e6194b", "#3cb44b", "#ffe119", "#4363d8", "#f58231", "#911eb4", "#46f0f0", "#f032e6", "#bcf60c", "#fabebe", "#008080", "#e6beff", "#9a6324", "#fffac8", "#800000", "#aaffc3", "#808000", "#ffd8b1", "#000075", "#808080", "#ffffff", "#000000"] }]}, options: {legend: { position: "right", labels: { fontColor: "#cccccc" }}}'+\
581 | 		'		});'+\
582 | 		'		var ctx = document.getElementById("chart2").getContext("2d");'+\
583 | 		'		var myChart = new Chart(ctx, {'+\
584 | 		'			type: "horizontalBar", data: { labels:['+allsslabels[0:-2]+'], datasets: [{ data: ['+allssdata[0:-1]+'], backgroundColor: "rgba(0,140,220,0.8)" }]}, options: {legend: { display: false }, scales: { xAxes: [{ ticks: { beginAtZero: true, fontColor: "#cccccc" } }], yAxes: [{ ticks: { fontColor: "#cccccc" } }] }  }'+\
585 | 		'		});'+\
586 | 		'	});'+\
587 | 		'</script>'
588 | 
589 | 	r['pretable'] += '<script>'+\
590 | 	'	$(document).ready(function() {'+\
591 | 	'		$("#scantitle").html("'+html.escape(request.session['scanfile'])+'");'+\
592 | 	'		$(".dropdown-trigger").dropdown();'+\
593 | 	'		$(".tooltipped").tooltip();'+\
594 | 	'		$(".perco").each(function() { '+\
595 | 	'			var pwidth = ( (($(this).attr("data-po") * 100) / '+str(totports)+') ); '+\
596 | 	'			/* console.log(pwidth); */ '+\
597 | 	'			$(this).css("width", pwidth+"%" ); '+\
598 | 	'			if($(this).attr("data-po") < 1) { $(this).html("&nbsp;"); $(this).css("background-color","#666") } '+\
599 | 	'		});'+\
600 | 	'	$("#detailstopports").html(\'<span class="small">'+str(allss[0:-2])+'</span>\');'+\
601 | 	'	});'+\
602 | 	'</script>'
603 | 	#r['pretable'] += '<button class="btn blue" onclick="javascript:$(\'.zeroportopen\').fadeToggle();">Hide/Show hosts with no open ports</button>'+\
604 | 	#'	<button class="btn red" onclick="javascript:genPDF(\''+scanmd5+'\');">PDF</button>'+\
605 | 	#'<br><br>'
606 | 
607 | 	return render(request, 'nmapreport/index.html', r)
608 | 
609 | 
610 | 


--------------------------------------------------------------------------------