├── .github
    └── workflows
    │   └── main.yml
├── .idea
    ├── .gitignore
    ├── SAP_Threat_Modeling.iml
    ├── dataSources.xml
    ├── inspectionProfiles
    │   └── profiles_settings.xml
    ├── misc.xml
    ├── modules.xml
    ├── sqldialects.xml
    └── vcs.xml
├── Dockerfile
├── LICENSE
├── README.md
├── app.py
├── images
    ├── 1.png
    ├── 2.png
    ├── 3.png
    ├── 4.png
    └── RedRays_Logo.png
├── requirements.txt
├── sap_utils
    ├── connections
    │   └── sap_connections.py
    └── scanning
    │   └── scan.py
└── templates
    ├── base.html
    ├── connectionsTable.html
    ├── index.html
    ├── launchpad.html
    └── threatMap.html


/.github/workflows/main.yml:
--------------------------------------------------------------------------------
 1 | name: Build and Deploy
 2 | 
 3 | on:
 4 |   push:
 5 |     branches: [ master ]
 6 | 
 7 | jobs:
 8 |   build:
 9 |     runs-on: ubuntu-latest
10 |     steps:
11 |       - uses: actions/checkout@v3
12 |       - name: Set up Python
13 |         uses: actions/setup-python@v4
14 |         with:
15 |           python-version: '3.9'
16 |       - name: Install dependencies
17 |         run: |
18 |           python -m pip install --upgrade pip
19 |           pip install -r requirements.txt
20 | 
21 |   build-and-push-image:
22 |     needs: build
23 |     runs-on: ubuntu-latest
24 |     permissions:
25 |       contents: read
26 |       packages: write
27 |     steps:
28 |       - uses: actions/checkout@v3
29 |       - name: Build Docker image
30 |         run: docker build -t ghcr.io/redrays-io/sap-threat-modeling:latest .
31 |       - name: Log in to Github Container Registry
32 |         uses: docker/login-action@v2
33 |         with:
34 |           registry: ghcr.io
35 |           username: ${{ github.repository_owner }}
36 |           password: ${{ secrets.GITHUB_TOKEN }}
37 |       - name: Push Docker image
38 |         run: docker push ghcr.io/redrays-io/sap-threat-modeling:latest
39 | 


--------------------------------------------------------------------------------
/.idea/.gitignore:
--------------------------------------------------------------------------------
1 | # Default ignored files
2 | /shelf/
3 | /workspace.xml
4 | # Editor-based HTTP Client requests
5 | /httpRequests/
6 | # Datasource local storage ignored files
7 | /dataSources/
8 | /dataSources.local.xml
9 | 


--------------------------------------------------------------------------------
/.idea/SAP_Threat_Modeling.iml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <module type="PYTHON_MODULE" version="4">
 3 |   <component name="Flask">
 4 |     <option name="enabled" value="true" />
 5 |   </component>
 6 |   <component name="NewModuleRootManager">
 7 |     <content url="file://$MODULE_DIR$">
 8 |       <excludeFolder url="file://$MODULE_DIR$/.venv" />
 9 |     </content>
10 |     <orderEntry type="inheritedJdk" />
11 |     <orderEntry type="sourceFolder" forTests="false" />
12 |   </component>
13 |   <component name="TemplatesService">
14 |     <option name="TEMPLATE_CONFIGURATION" value="Jinja2" />
15 |     <option name="TEMPLATE_FOLDERS">
16 |       <list>
17 |         <option value="$MODULE_DIR$/../SAP_Threat_Modeling\templates" />
18 |       </list>
19 |     </option>
20 |   </component>
21 | </module>


--------------------------------------------------------------------------------
/.idea/dataSources.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <project version="4">
 3 |   <component name="DataSourceManagerImpl" format="xml" multifile-model="true">
 4 |     <data-source source="LOCAL" name="db.sqlite" uuid="a5a4b922-c916-41e9-96df-a30f65b157dc">
 5 |       <driver-ref>sqlite.xerial</driver-ref>
 6 |       <synchronize>true</synchronize>
 7 |       <jdbc-driver>org.sqlite.JDBC</jdbc-driver>
 8 |       <jdbc-url>jdbc:sqlite:$PROJECT_DIR$/db.sqlite</jdbc-url>
 9 |       <working-dir>$ProjectFileDir$</working-dir>
10 |     </data-source>
11 |   </component>
12 | </project>


--------------------------------------------------------------------------------
/.idea/inspectionProfiles/profiles_settings.xml:
--------------------------------------------------------------------------------
1 | <component name="InspectionProjectProfileManager">
2 |   <settings>
3 |     <option name="USE_PROJECT_PROFILE" value="false" />
4 |     <version value="1.0" />
5 |   </settings>
6 | </component>


--------------------------------------------------------------------------------
/.idea/misc.xml:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="UTF-8"?>
2 | <project version="4">
3 |   <component name="Black">
4 |     <option name="sdkName" value="Python 3.11 (SAP_Threat_Modeling)" />
5 |   </component>
6 |   <component name="ProjectRootManager" version="2" project-jdk-name="Python 3.11 (SAP_Threat_Modeling)" project-jdk-type="Python SDK" />
7 | </project>


--------------------------------------------------------------------------------
/.idea/modules.xml:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="UTF-8"?>
2 | <project version="4">
3 |   <component name="ProjectModuleManager">
4 |     <modules>
5 |       <module fileurl="file://$PROJECT_DIR$/.idea/SAP_Threat_Modeling.iml" filepath="$PROJECT_DIR$/.idea/SAP_Threat_Modeling.iml" />
6 |     </modules>
7 |   </component>
8 | </project>


--------------------------------------------------------------------------------
/.idea/sqldialects.xml:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="UTF-8"?>
2 | <project version="4">
3 |   <component name="SqlDialectMappings">
4 |     <file url="file://$PROJECT_DIR$/app.py" dialect="SQLite" />
5 |   </component>
6 | </project>


--------------------------------------------------------------------------------
/.idea/vcs.xml:
--------------------------------------------------------------------------------
1 | <?xml version="1.0" encoding="UTF-8"?>
2 | <project version="4">
3 |   <component name="VcsDirectoryMappings">
4 |     <mapping directory="$PROJECT_DIR$" vcs="Git" />
5 |   </component>
6 | </project>


--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM python:3.9-slim-buster
 2 | 
 3 | WORKDIR /app
 4 | 
 5 | # Install system dependencies
 6 | RUN apt-get update && apt-get install -y \
 7 |     libpq-dev \
 8 |     gcc
 9 | 
10 | # Install Python dependencies
11 | COPY requirements.txt .
12 | RUN pip install --no-cache-dir -r requirements.txt
13 | 
14 | # Copy application files
15 | COPY . .
16 | 
17 | # Expose port
18 | EXPOSE 5000
19 | 
20 | # Run the application
21 | CMD ["flask", "run", "--host=0.0.0.0"]


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2024 RedRays, Inc
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | <div style="text-align:center">
 2 |     <img src="images/RedRays_Logo.png" alt="screenshot" width="200" height="200">
 3 | </div>
 4 | 
 5 | # SAP Threat Modeling Tool - Readme
 6 | 
 7 | This tool helps you analyze and visualize connections between your SAP systems, enabling identification of potential security risks and vulnerabilities.
 8 | 
 9 | For more detailed information about potential threats in SAP systems related to inter-SAP connections, visit [this page](https://redrays.io/blog/securing-sap-server-connections-threat-modeling/).
10 | ## Features:
11 | 
12 | - **Input SAP Credentials:** Enter system details (SID, username, password, etc.) to establish initial connections.
13 | - **Scan for Inter-SAP Connections:** Discover and display connections between your SAP systems, including usernames and password storage flags.
14 | - **Visualize the Network:** View a graph representation of your SAP network, highlighting connections with potential security concerns.
15 | - **Filter Connections:** Focus on specific connections, such as those with stored passwords.
16 | 
17 | ## Usage:
18 | 
19 | 1. **Initiate Connections:**
20 |     - Navigate to the "Init Connections" page.
21 |     - Enter SAP system credentials similar to the format shown in this ![screenshot](images/1.png).
22 |     - Save the connection details and click "Scan" to start the analysis.
23 | 
24 | 2. **View Existing Connections:**
25 |     - After the scan is completed, go to the "Connections Table" page.
26 |     - Here, you can view all existing connections in a tabular format as depicted in this ![screenshot](images/2.png).
27 | 
28 | 3. **Explore Inter-SAP Connections:**
29 |     - Alternatively, visit the "Graph Connection" page to visualize the inter-SAP connections in a graph format like shown in this ![screenshot](images/3.png).
30 |     - You can filter the connections to display only those with saved passwords, as demonstrated in this ![screenshot](images/4.png).
31 | 
32 | 
33 | ## Installation:
34 | 
35 | 1. Clone the repository:
36 |     ```bash
37 |     git clone https://github.com/redrays-io/SAP-Threat-Modeling-Tool.git
38 |     ```
39 |     Use code with caution.
40 | 
41 | 2. Install dependencies:
42 |     ```bash
43 |     pip install -r requirements.txt
44 |     ```
45 |     Use code with caution.
46 | 
47 | 3. Run the application:
48 |     ```bash
49 |     python app.py
50 |     ```
51 |     Use code with caution.
52 | 
53 | 4. Access the web interface: Open [http://localhost:5000](http://localhost:5000) in your browser.
54 | 
55 | 
56 | ## Docker Setup:
57 | Alternatively, you can set up the tool using Docker with the following command:
58 | 
59 | ```bash
60 | docker pull ghcr.io/redrays-io/sap-threat-modeling:latest
61 | ```
62 | 
63 | ## Security Considerations:
64 | 
65 | - **Credential Storage:** This tool stores SAP credentials in a local SQLite database. Ensure proper security measures for the database file.
66 | - **Data Sensitivity:** The tool exposes information about SAP connections and potential vulnerabilities. Limit access to authorized personnel only.
67 | - **Production Use:** This tool is intended for development and testing purposes. Evaluate its suitability before using it in production environments.
68 | 


--------------------------------------------------------------------------------
/app.py:
--------------------------------------------------------------------------------
  1 | import sqlite3
  2 | from flask import Flask, request, render_template, jsonify
  3 | from sap_utils.scanning.scan import scan_systems
  4 | 
  5 | app = Flask(__name__)
  6 | 
  7 | # Constants
  8 | DB_FILE = "db.sqlite"
  9 | 
 10 | 
 11 | # Database initialization
 12 | def initialize_database(db_file):
 13 |     with sqlite3.connect(db_file) as conn:
 14 |         cursor = conn.cursor()
 15 | 
 16 |         # Create credentials table if not exists
 17 |         cursor.execute('''CREATE TABLE IF NOT EXISTS credentials (
 18 |                             id INTEGER PRIMARY KEY AUTOINCREMENT,
 19 |                             sid TEXT,
 20 |                             client TEXT,
 21 |                             host TEXT,
 22 |                             port TEXT,
 23 |                             use_https INTEGER,
 24 |                             username TEXT,
 25 |                             password TEXT
 26 |                         )''')
 27 | 
 28 |         # Create sap_connections table if not exists
 29 |         cursor.execute('''CREATE TABLE IF NOT EXISTS sap_connections (
 30 |                             id INTEGER PRIMARY KEY AUTOINCREMENT,
 31 |                             connection_name TEXT,
 32 |                             connection_type TEXT,
 33 |                             connection_from TEXT,
 34 |                             connection_to TEXT,
 35 |                             username TEXT,
 36 |                             password_flag BOOLEAN
 37 |                         )''')
 38 | 
 39 | 
 40 | # Initialize the database
 41 | initialize_database(DB_FILE)
 42 | 
 43 | 
 44 | # Routes
 45 | @app.route('/')
 46 | def index():
 47 |     return render_template('index.html')
 48 | 
 49 | 
 50 | @app.route('/remove_connection', methods=['POST'])
 51 | def remove_connection():
 52 |     data = request.get_json()
 53 |     print(data)
 54 |     sid = data['sid']
 55 |     host = data['host']
 56 |     port = data['port']
 57 | 
 58 |     with sqlite3.connect(DB_FILE) as conn:
 59 |         cursor = conn.cursor()
 60 |         cursor.execute('''DELETE FROM credentials WHERE sid = ? AND host = ? AND port = ?''', (sid, host, port))
 61 |         conn.commit()
 62 | 
 63 |     return jsonify({'message': 'Connection removed successfully!'})
 64 | 
 65 | 
 66 | @app.route('/launchpad')
 67 | def launchpad():
 68 |     with sqlite3.connect(DB_FILE) as conn:
 69 |         cursor = conn.cursor()
 70 |         cursor.execute('''SELECT sid, username, password, client, use_https, host, port FROM credentials''')
 71 |         connections = cursor.fetchall()
 72 | 
 73 |     return render_template('launchpad.html', connections=connections)
 74 | 
 75 | 
 76 | @app.route('/connectionsTable')
 77 | def connectionsTable():
 78 |     with sqlite3.connect(DB_FILE) as conn:
 79 |         cursor = conn.cursor()
 80 |         cursor.execute('''SELECT * FROM sap_connections''')
 81 |         connections = cursor.fetchall()
 82 | 
 83 |     return render_template('connectionsTable.html', connections=connections)
 84 | 
 85 | 
 86 | @app.route('/threatMap')
 87 | def threatMap():
 88 |     return render_template('threatMap.html')
 89 | 
 90 | 
 91 | @app.route('/save_data', methods=['POST'])
 92 | def save_data():
 93 |     data_list = request.get_json()
 94 | 
 95 |     with sqlite3.connect(DB_FILE) as conn:
 96 |         cursor = conn.cursor()
 97 |         for data in data_list:
 98 |             cursor.execute('''INSERT INTO credentials (sid, client, host, port, use_https, username, password)
 99 |                               VALUES (?, ?, ?, ?, ?, ?, ?)''',
100 |                            (
101 |                            data['sid'], data['client'], data['host'], data['port'], data['use_https'], data['username'],
102 |                            data['password']))
103 |         conn.commit()
104 | 
105 |     return jsonify({'message': 'Data saved successfully!'})
106 | 
107 | 
108 | @app.route('/scan', methods=['GET'])
109 | def scan():
110 |     with sqlite3.connect(DB_FILE) as conn:
111 |         cursor = conn.cursor()
112 |         cursor.execute('''SELECT sid, client, host, port, use_https, username, password FROM credentials''')
113 |         credentials = cursor.fetchall()
114 |         cursor.execute('''DELETE FROM sap_connections''')
115 | 
116 |         sap_connection_array = []
117 |         for credential in credentials:
118 |             sap_connection_array.append({
119 |                 'sid': credential[0],
120 |                 'client': credential[1],
121 |                 'host': credential[2],
122 |                 'port': credential[3],
123 |                 'use_https': credential[4],
124 |                 'username': credential[5],
125 |                 'password': credential[6],
126 |             })
127 |         for sap_connection in sap_connection_array:
128 |                 scan_result_list = scan_systems(sap_connection['host'], sap_connection['port'],
129 |                                                 sap_connection['client'], sap_connection['username'],
130 |                                                 sap_connection['password'], sap_connection['use_https'])
131 |                 for scan_result in scan_result_list:
132 |                     cursor.execute('''INSERT INTO sap_connections 
133 |                                      (connection_name, connection_type, connection_from, connection_to, username, password_flag)
134 |                                      VALUES (?, ?, ?, ?, ?, ?)''',
135 |                                    (scan_result.connection_name, scan_result.connection_type,
136 |                                     scan_result.connection_from, scan_result.connection_to, scan_result.username,
137 |                                     scan_result.password_flag))
138 |                     print(scan_result)
139 |         conn.commit()
140 | 
141 |     return jsonify('')
142 | 
143 | 
144 | @app.route('/get_connections')
145 | def get_connections():
146 |     try:
147 |         password_only = request.args.get('password_only')
148 | 
149 |         with sqlite3.connect(DB_FILE) as conn:
150 |             cursor = conn.cursor()
151 |             if password_only and password_only.lower() == 'true':
152 |                 cursor.execute(
153 |                     '''SELECT connection_from, connection_to, connection_name FROM sap_connections WHERE password_flag = 1''')
154 |             else:
155 |                 cursor.execute('''SELECT connection_from, connection_to, connection_name FROM sap_connections''')
156 |             connections = cursor.fetchall()
157 | 
158 |         connection_data = [
159 |             {'connection_from': connection[0], 'connection_to': connection[1], 'connection_name': connection[2]} for
160 |             connection in connections]
161 |         return jsonify(connection_data)
162 |     except Exception as e:
163 |         return jsonify({'error': str(e)})
164 | 
165 | 
166 | if __name__ == '__main__':
167 |     app.run(debug=False)
168 | 


--------------------------------------------------------------------------------
/images/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/redrays-io/SAP-Threat-Modeling/083ceb25d4325709bf50d0357fd3a85f2657a451/images/1.png


--------------------------------------------------------------------------------
/images/2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/redrays-io/SAP-Threat-Modeling/083ceb25d4325709bf50d0357fd3a85f2657a451/images/2.png


--------------------------------------------------------------------------------
/images/3.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/redrays-io/SAP-Threat-Modeling/083ceb25d4325709bf50d0357fd3a85f2657a451/images/3.png


--------------------------------------------------------------------------------
/images/4.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/redrays-io/SAP-Threat-Modeling/083ceb25d4325709bf50d0357fd3a85f2657a451/images/4.png


--------------------------------------------------------------------------------
/images/RedRays_Logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/redrays-io/SAP-Threat-Modeling/083ceb25d4325709bf50d0357fd3a85f2657a451/images/RedRays_Logo.png


--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/redrays-io/SAP-Threat-Modeling/083ceb25d4325709bf50d0357fd3a85f2657a451/requirements.txt


--------------------------------------------------------------------------------
/sap_utils/connections/sap_connections.py:
--------------------------------------------------------------------------------
 1 | class SAPConnection:
 2 |     def __init__(self, connection_name, connection_type, connection_from, connection_to, username, password_flag):
 3 |         self.connection_name = connection_name
 4 |         self.connection_type = connection_type
 5 |         self.connection_from = connection_from
 6 |         self.connection_to = connection_to
 7 |         self.username = username
 8 |         self.password_flag = password_flag
 9 | 
10 |     def display_info(self):
11 |         print("Connection Name:", self.connection_name)
12 |         print("Connection Type:", self.connection_type)
13 |         print("Connection From:", self.connection_from)
14 |         print("Connection To:", self.connection_to)
15 |         print("Connection username:", self.username)
16 |         print("Connection Password saved:", self.password_flag)
17 | 


--------------------------------------------------------------------------------
/sap_utils/scanning/scan.py:
--------------------------------------------------------------------------------
  1 | import base64
  2 | import re
  3 | import xml.etree.ElementTree as ET
  4 | 
  5 | import requests
  6 | 
  7 | from sap_utils.connections.sap_connections import SAPConnection
  8 | 
  9 | """
 10 | --------------------------------------------------------------------------------
 11 | | Key         | Meaning / Explanation                                                         |  
 12 | |-------------|------------------------------------------------------------------------------|  
 13 | | H=          | Hostname or IP address                                                       |  
 14 | | S=          | System number                                                                |  
 15 | | M=          | Client number                                                                |  
 16 | | U=          | RFC user                                                                     |  
 17 | | L=          | Language                                                                     |  
 18 | | X=          | Load balancing (LB=ON)                                                       |  
 19 | | I=          | System ID                                                                    |  
 20 | | N=          | Logon group                                                                  |  
 21 | | Z=          | Various authentication-related parameters                                    |  
 22 | | g=          | Gateway server                                                               |  
 23 | | F=          | Enforce codepage                                                             |  
 24 | | f=Y         | RFC Ticket for Java                                                          |  
 25 | | J=...       | SSL Client Application                                                       |  
 26 | | j=Y         | RFC Unicode-Support                                                          |  
 27 | | m=Y         | MDMP Settings (Multi-Display/Multi-Processing)                               |  
 28 | | rfcsnc:     | SNC activated (secure connection)                                            |  
 29 | | t=...       | SSL Client Application                                                       |  
 30 | | r=...       | Proxy password                                                               |  
 31 | | R=...       | Proxy user                                                                   |  
 32 | | v=...       | Saved password                                                               |  
 33 | | z=...       | KEEPALIVE timeout                                                            |  
 34 | | y=...       | CPIC timeout                                                                 |  
 35 | | h=...       | REACT or Trace option                                                        |  
 36 | | e=...       | GW Starttype (internal gateway param)                                        |  
 37 | | q=          | qRFCVERS start (queued RFC version)                                          |  
 38 | | w=...       | RFCCATEGORY start (custom category)                                          |  
 39 | | F=.         | RFCHTTP-Structure (overload of the key “F” in some configurations)           |  
 40 | | N=.         | Path-Prefix for RFC requests                                                 |  
 41 | | d=.         | Unicode-Flag                                                                 |  
 42 | | k=Y         | rfcwan: slow connection                                                      |  
 43 | | x=.         | Authority checks                                                             |  
 44 | | b=Y         | RFCLOGON -> Login screen                                                     |  
 45 | | i=Y         | SAVESERVER as IP                                                             |  
 46 | | u=Y         | RFC same user prepared                                                       |  
 47 | | O=X         | ARFC-Option prepared                                                         |  
 48 | | l=X         | Display unchangeable (locked)                                                |
 49 | --------------------------------------------------------------------------------
 50 | """
 51 | 
 52 | xml_request_body_rfc_read_table = """<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:sap-com:document:sap:rfc:functions">
 53 |    <soapenv:Header/>
 54 |    <soapenv:Body>
 55 |       <urn:_-BODS_-RFC_READ_TABLE>
 56 |          <DATA>
 57 |             <item>
 58 |                <WA></WA>
 59 |             </item>
 60 |          </DATA>
 61 |          <DELIMITER>|</DELIMITER>
 62 |          <FIELDS>
 63 | <item>
 64 |                <FIELDNAME>RFCDEST</FIELDNAME>
 65 | </item>
 66 | <item>
 67 |                <FIELDNAME>RFCTYPE</FIELDNAME>
 68 | </item>
 69 |             <item>
 70 |                <FIELDNAME>RFCOPTIONS</FIELDNAME>
 71 |             </item>
 72 |          </FIELDS>
 73 |          <QUERY_TABLE>RFCDES</QUERY_TABLE>
 74 |       </urn:_-BODS_-RFC_READ_TABLE>
 75 |    </soapenv:Body>
 76 | </soapenv:Envelope>"""
 77 | delimiter = "|"
 78 | connect_to_regexp = r"H=([^,]+)"
 79 | saved_password_regexp = r"v=([^,]+)"
 80 | username_regexp = "[U D]=([^,]+)"
 81 | 
 82 | 
 83 | def send_request(host, port, sap_client, username, password, secure=True):
 84 |     # Determine the scheme based on the 'secure' parameter
 85 |     scheme = "https" if secure else "http"
 86 | 
 87 |     # Construct the URL
 88 |     url = f"{scheme}://{host}:{port}/sap/bc/soap/rfc?sap-client={sap_client}"
 89 | 
 90 |     # Prepare headers
 91 |     headers = {
 92 |         "Content-Type": "text/xml",
 93 |         "User-Agent": "RedRays Threat Modeling OSS/1.0.0"
 94 |     }
 95 | 
 96 |     # Encode username and password for Basic Authentication
 97 |     encoded_auth = base64.b64encode(f"{username}:{password}".encode("utf-8")).decode("ascii")
 98 |     headers["Authorization"] = f"Basic {encoded_auth}"
 99 | 
100 |     # Send the request
101 |     response = requests.post(url, headers=headers, data=xml_request_body_rfc_read_table)
102 | 
103 |     # Print response
104 |     print("Response Status Code:", response.status_code)
105 |     return response.text
106 | 
107 | 
108 | def parse_xml(xml_input):
109 |     wa_values = []
110 |     try:
111 |         # Parse the XML string
112 |         root = ET.fromstring(xml_input)
113 | 
114 |         for sid in root.iterfind('.//item//WA'):
115 |             wa_values.append(sid.text)
116 | 
117 |     except Exception as e:
118 |         print("An error occurred while parsing XML:", e)
119 | 
120 |     return wa_values
121 | 
122 | 
123 | def scan_systems(host, port, sap_client, username, password, secure=True):
124 |     sap_connection_array = []
125 | 
126 |     response_text = send_request(host, port, sap_client, username, password, secure=False)
127 |     wa_values = parse_xml(response_text)
128 |     print(wa_values)
129 |     for wa_value in wa_values:
130 |         if wa_value is not None:
131 |             connection_array = wa_value.split(delimiter)
132 |             match_connection_to = re.search(connect_to_regexp, connection_array[2])
133 |             saved_password_match = re.search(saved_password_regexp, connection_array[2])
134 |             match_username = re.search(username_regexp, connection_array[2])
135 | 
136 |             if match_connection_to is not None:
137 |                 saved_password = saved_password_match.group(1) if saved_password_match else ''
138 |                 username = match_username.group(1) if match_username else ''
139 | 
140 |                 sap_connection_array.append(SAPConnection(connection_array[0], connection_array[1], host,
141 |                                                           match_connection_to.group(1), username,
142 |                                                           saved_password_match is not None))
143 | 
144 |     return sap_connection_array
145 | 
146 | 
147 | # Example usage
148 | if __name__ == "__main__":
149 |     host = "sap.local"
150 |     port = 50000
151 |     sap_client = "000"
152 |     username = "SAP*"
153 |     password = "asdQWE123#"
154 |     sap_connections = scan_systems(host, port, sap_client, username, password)
155 |     print(sap_connections)
156 | 


--------------------------------------------------------------------------------
/templates/base.html:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html lang="en">
 3 | <head>
 4 |     <meta charset="UTF-8">
 5 |     <meta name="viewport" content="width=device-width, initial-scale=1.0">
 6 |     <title>{% block title %}{% endblock %}</title>
 7 |     <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
 8 |     <!-- <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}"> -->
 9 |     <script src="https://cdnjs.cloudflare.com/ajax/libs/vis/4.21.0/vis.min.js"
10 |             integrity="sha512-XHDcSyqhOoO2ocB7sKOCJEkUjw/pQCJViP1ynpy+EGh/LggzrP6U/V3a++LQTnZT7sCQKeHRyWHfhN2afjXjCg=="
11 |             crossorigin="anonymous" referrerpolicy="no-referrer"></script>
12 | </head>
13 | <body>
14 | <nav class="navbar navbar-expand-lg navbar-light bg-light">
15 |     <a class="navbar-brand" href="#">SAP Threat Modeling</a>
16 |     <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarNav"
17 |             aria-controls="navbarNav" aria-expanded="false" aria-label="Toggle navigation">
18 |         <span class="navbar-toggler-icon"></span>
19 |     </button>
20 |     <div class="collapse navbar-collapse" id="navbarNav">
21 |         <ul class="navbar-nav">
22 |             <li class="nav-item">
23 |                 <a class="nav-link" href="{{ url_for('index') }}">Home</a>
24 |             </li>
25 |             <div style="display: inline-block; border-right: 1px solid #ccc; height: 40px;"></div>
26 |             <li class="nav-item">
27 |                 <a class="nav-link" href="{{ url_for('launchpad') }}">Launchpad</a>
28 |             </li>
29 |             <div style="display: inline-block; border-right: 1px solid #ccc; height: 40px;"></div>
30 |             <li class="nav-item">
31 |                 <a class="nav-link" href="{{ url_for('connectionsTable') }}">Connections Table</a>
32 |             </li>
33 |             <div style="display: inline-block; border-right: 1px solid #ccc; height: 40px;"></div>
34 |             <li class="nav-item">
35 |                 <a class="nav-link" href="{{ url_for('threatMap') }}">Threat Map</a>
36 |             </li>
37 |         </ul>
38 |     </div>
39 | </nav>
40 | 
41 | <div class="container">
42 |     {% block content %}{% endblock %}
43 | </div>
44 | 
45 | <footer class="footer mt-5 py-3 bg-light" style="position: fixed; bottom: 0; width: 100%;">
46 |     <div class="container" style="margin-left: 0">
47 |         <span class="text-muted">© 2024 SAP Threat Modeling</span>
48 |     </div>
49 | </footer>
50 | 
51 | 
52 | <script src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>
53 | <script src="https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js"></script>
54 | <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"></script>
55 | </body>
56 | </html>


--------------------------------------------------------------------------------
/templates/connectionsTable.html:
--------------------------------------------------------------------------------
 1 | {% extends 'base.html' %}
 2 | 
 3 | {% block title %}SAP Connections{% endblock %}
 4 | 
 5 | {% block content %}
 6 |     <h2>SAP Connections Table</h2>
 7 |     <table class="table">
 8 |         <thead>
 9 |             <tr>
10 |                 <th scope="col">#</th>
11 |                 <th scope="col">Connection Name</th>
12 |                 <th scope="col">Connection Type</th>
13 |                 <th scope="col">Connection From</th>
14 |                 <th scope="col">Connection To</th>
15 |                 <th scope="col">Username</th>
16 |                 <th scope="col">Stored Password Flag</th>
17 |             </tr>
18 |         </thead>
19 |         <tbody>
20 |             {% for connection in connections %}
21 |             <tr>
22 |                 <td>{{ connection[0] }}</td>
23 |                 <td>{{ connection[1] }}</td>
24 |                 <td>{{ connection[2] }}</td>
25 |                 <td>{{ connection[3] }}</td>
26 |                 <td>{{ connection[4] }}</td>
27 |                 <td>{{ connection[5] }}</td>
28 |                 <td>{{ connection[6] }}</td>
29 |             </tr>
30 |             {% endfor %}
31 |         </tbody>
32 |     </table>
33 | {% endblock %}
34 | 


--------------------------------------------------------------------------------
/templates/index.html:
--------------------------------------------------------------------------------
 1 | {% extends 'base.html' %}
 2 | 
 3 | {% block title %}Home Page{% endblock %}
 4 | 
 5 | {% block content %}
 6 |     <h1>Welcome to the SAP Threat Modeling Tool</h1>
 7 | 
 8 |     <p>This application helps you analyze and visualize the connections between your SAP systems, enabling you to identify potential security risks and vulnerabilities.</p>
 9 | 
10 |     <h2>How it Works:</h2>
11 | 
12 |     <ol>
13 |         <li>
14 |             **Initial Connections:**<br>
15 |             Start by inputting the credentials of your SAP systems on the "Init Connections" page. This includes the System ID (SID), username, password, client number, host address, and port number. You can add multiple systems and easily remove them if needed.
16 |         </li>
17 |         <li>
18 |             **Scanning for Inter-SAP Connections:**<br>
19 |             Once you've added your initial connections, click the "Scan" button. The tool will then analyze your SAP systems and discover the connections between them. This information, including connection names, types, source and destination systems, usernames, and password storage flags, is displayed on the "Inter-SAP Connections" page.
20 |         </li>
21 |         <li>
22 |             **Visualizing the Network:**<br>
23 |             The "Graph Connection" page provides a visual representation of your SAP network. Each system is represented as a node, and the connections between them are shown as lines. You can filter the graph to only show connections with stored passwords, highlighting potential security concerns.
24 |         </li>
25 |     </ol>
26 | 
27 |     <h2>Benefits:</h2>
28 | 
29 |     <ul>
30 |         <li>Identify systems with saved passwords, which pose a significant security risk.</li>
31 |         <li>Understand the flow of data between systems to assess potential breach impact.</li>
32 |         <li>Evaluate the overall security posture of your SAP environment.</li>
33 |     </ul>
34 | 
35 |     <p>Start exploring your SAP network today and take control of your system's security!</p>
36 | {% endblock %}


--------------------------------------------------------------------------------
/templates/launchpad.html:
--------------------------------------------------------------------------------
  1 | {% extends 'base.html' %}
  2 | {% block title %}SAP Connections{% endblock %}
  3 | 
  4 | {% block content %}
  5 |     <h2>SAP Connection Credentials</h2>
  6 |     <table class="table">
  7 |         <thead>
  8 |         <tr>
  9 |             <th>SID</th>
 10 |             <th>Username</th>
 11 |             <th>Password</th>
 12 |             <th>Client</th>
 13 |             <th>HTTPS</th>
 14 |             <th>Host</th>
 15 |             <th>Port</th>
 16 |             <th>Action</th>
 17 |         </tr>
 18 |         </thead>
 19 |         <tbody id="credentialsTableBody">
 20 |         {% for connection in connections %}
 21 |             <tr data-sid="{{ connection[0] }}">
 22 |                 <td>{{ connection[0] }}</td>
 23 |                 <td>{{ connection[1] }}</td>
 24 |                 <td>**********</td>
 25 |                 <td>{{ connection[3] }}</td>
 26 |                 <td>{{ "HTTPS" if connection[4] else "HTTP" }}</td>
 27 |                 <td>{{ connection[5] }}</td>
 28 |                 <td>{{ connection[6] }}</td>
 29 |                 <td>
 30 |                     <button class="btn btn-danger"
 31 |                             onclick="removeConnection('{{ connection[0] }}', '{{ connection[5] }}', '{{ connection[6] }}')">
 32 |                         Remove
 33 |                     </button>
 34 |                 </td>
 35 |             </tr>
 36 |         {% endfor %}
 37 |         </tbody>
 38 |     </table>
 39 |     <button id="addRowBtn" class="btn btn-primary">Add Row</button>
 40 |     <button id="saveButton" class="btn btn-success" disabled>Save</button>
 41 |     <button id="scanButton" class="btn btn-info {% if connections %} {% else %}disabled{% endif %}"
 42 |             {% if not connections %}disabled{% endif %}>Scan
 43 |     </button>
 44 | 
 45 |     <!-- Notification element -->
 46 |     <div id="notification" class="alert alert-success" role="alert" style="display: none;">
 47 |         Data saved successfully!
 48 |     </div>
 49 | 
 50 |     <script>
 51 |         const tableBody = document.getElementById('credentialsTableBody');
 52 |         const addRowBtn = document.getElementById('addRowBtn');
 53 |         const saveButton = document.getElementById('saveButton');
 54 |         const scanButton = document.getElementById('scanButton');
 55 |         const notification = document.getElementById('notification');
 56 | 
 57 |         function addRow() {
 58 |             const newRow = tableBody.insertRow();
 59 |             newRow.innerHTML = `
 60 |                  <td><input id="sidInput" type="text" class="form-control"></td>
 61 |             <td><input id="usernameInput" type="text" class="form-control"></td>
 62 |             <td><input id="passwordInput" type="password" class="form-control"></td>
 63 |             <td><input id="clientInput" type="text" class="form-control"></td>
 64 |             <td>
 65 |                 <select id="protocolSelect" class="form-control" style="width: 100px;">
 66 |                     <option value="http">HTTP</option>
 67 |                     <option value="https">HTTPS</option>
 68 |                 </select>
 69 |             </td>
 70 |             <td><input id="hostInput" type="text" class="form-control"></td>
 71 |             <td><input id="portInput" type="number" class="form-control"></td>
 72 |             <td><button class="btn btn-danger" onclick="deleteRow(this)">Remove</button></td>
 73 |             `;
 74 |             // Enable save button when a row is added
 75 |             saveButton.disabled = false;
 76 |         }
 77 | 
 78 |         function deleteRow(btn) {
 79 |             const row = btn.parentNode.parentNode;
 80 |             row.parentNode.removeChild(row);
 81 |             // Disable save button if no rows are left after deletion
 82 |             if (tableBody.querySelectorAll('tr').length === 0) {
 83 |                 saveButton.disabled = true;
 84 |             }
 85 |         }
 86 | 
 87 |         function removeConnection(sid, host, port) {
 88 |             fetch('/remove_connection', {
 89 |                 method: 'POST',
 90 |                 headers: {
 91 |                     'Content-Type': 'application/json'
 92 |                 },
 93 |                 body: JSON.stringify({'sid': sid, 'host': host, 'port': port})
 94 |             })
 95 |                 .then(response => response.json())
 96 |                 .then(data => {
 97 |                     console.log('Server response:', data);
 98 |                     // Remove the corresponding row from the table
 99 |                     const row = document.querySelector(`tr[data-sid="${sid}"]`);
100 |                     if (row) {
101 |                         row.remove();
102 |                     }
103 |                     // Check if connections exist and enable/disable scan button accordingly
104 |                     scanButton.disabled = document.querySelectorAll('#credentialsTableBody tr').length === 0;
105 |                     scanButton.classList.toggle('disabled', scanButton.disabled);
106 |                 })
107 |                 .catch(error => console.error('Error:', error));
108 |         }
109 | 
110 |         function collectData() {
111 |             const rows = tableBody.querySelectorAll('td input, td select');
112 |             const data = [];
113 |             rows.forEach((input, index) => {
114 |                 const rowIndex = Math.floor(index / 7); // Assuming there are 7 inputs per row
115 |                 const inputIndex = index % 7;
116 |                 if (!data[rowIndex]) {
117 |                     data[rowIndex] = {};
118 |                 }
119 |                 switch (inputIndex) {
120 |                     case 0:
121 |                         data[rowIndex].sid = input.value;
122 |                         break;
123 |                     case 1:
124 |                         data[rowIndex].username = input.value;
125 |                         break;
126 |                     case 2:
127 |                         data[rowIndex].password = input.value;
128 |                         break;
129 |                     case 3:
130 |                         data[rowIndex].client = input.value;
131 |                         break;
132 |                     case 4:
133 |                         data[rowIndex].use_https = input.value === "https";
134 |                         break;
135 |                     case 5:
136 |                         data[rowIndex].host = input.value;
137 |                         break;
138 |                     case 6:
139 |                         data[rowIndex].port = input.value;
140 |                         break;
141 |                     default:
142 |                         break;
143 |                 }
144 |             });
145 |             return data;
146 |         }
147 | 
148 | 
149 |         saveButton.addEventListener('click', () => {
150 |             const data = collectData();
151 |             fetch('/save_data', {
152 |                 method: 'POST',
153 |                 headers: {
154 |                     'Content-Type': 'application/json'
155 |                 },
156 |                 body: JSON.stringify(data)
157 |             })
158 |                 .then(response => response.json())
159 |                 .then(data => {
160 |                     console.log('Server response:', data);
161 |                     // Show notification
162 |                     notification.style.display = 'block';
163 |                     setTimeout(() => {
164 |                         notification.style.display = 'none';
165 |                     }, 3000); // Hide after 3 seconds
166 | 
167 |                     // Enable scan button after saving data
168 |                     scanButton.disabled = false;
169 | 
170 |                     window.location.reload();
171 | 
172 |                 })
173 |                 .catch(error => console.error('Error:', error));
174 |         });
175 | 
176 |         scanButton.addEventListener('click', () => {
177 |             fetch('/scan', {
178 |                 method: 'GET'
179 |             })
180 |                 .then(response => response.json())
181 |                 .then(data => {
182 |                     console.log('Scan result:', data);
183 |                     // Handle scan result here, if needed
184 |                 })
185 |                 .catch(error => console.error('Error:', error));
186 |         });
187 | 
188 |         addRowBtn.addEventListener('click', addRow);
189 |     </script>
190 | {% endblock %}


--------------------------------------------------------------------------------
/templates/threatMap.html:
--------------------------------------------------------------------------------
 1 | {% extends 'base.html' %}
 2 | 
 3 | {% block title %}Threat Map{% endblock %}
 4 | 
 5 | {% block content %}
 6 |     <div class="container-fluid">
 7 |         <div class="row" style="width: 100vh">
 8 |             <div class="col-md-12">
 9 |                 <div id="mynetwork"></div>
10 |             </div>
11 |         </div>
12 |         <div class="form-check">
13 |             <input class="form-check-input" type="checkbox" id="checkbox" onchange="updateConnections()">
14 |             <label class="form-check-label" for="checkbox">
15 |                 Show connections with stored password only
16 |             </label>
17 |         </div>
18 |     </div>
19 | 
20 |     <script type="text/javascript">
21 |         var nodes = [];
22 |         var edges = [];
23 |         var checkbox = document.getElementById('checkbox');
24 | 
25 |         function updateConnections() {
26 |             // Clear existing nodes and edges
27 |             nodes = [];
28 |             edges = [];
29 | 
30 |             // Fetch connection data from the server
31 |             fetch('/get_connections?password_only=' + checkbox.checked)
32 |                 .then(response => response.json())
33 |                 .then(data => {
34 |                     // Process the connection data
35 |                     data.forEach(connection => {
36 |                         // Add unique IP addresses from connection_from and connection_to as nodes
37 |                         addNode(connection.connection_from);
38 |                         addNode(connection.connection_to);
39 | 
40 |                         // Add the connection as an edge with adjusted length
41 |                         edges.push({
42 |                             from: connection.connection_from,
43 |                             to: connection.connection_to,
44 |                             label: connection.connection_name,
45 |                             arrows: 'to',
46 |                             length: 500 // Adjusted length to accommodate longer labels
47 |                         });
48 |                     });
49 | 
50 |                     // Create a network
51 |                     var container = document.getElementById('mynetwork');
52 |                     var data = {
53 |                         nodes: nodes,
54 |                         edges: edges,
55 |                     };
56 |                     var options = {
57 |                         height: '800px',
58 |                         width: '1000px',
59 |                         edges: {
60 |                             font: {
61 |                                 align: 'middle'
62 |                             }
63 |                         }
64 |                     };
65 |                     var network = new vis.Network(container, data, options);
66 |                 })
67 |                 .catch(error => console.error('Error:', error));
68 |         }
69 | 
70 |         // Function to add a node if it doesn't already exist
71 |         function addNode(nodeId) {
72 |             if (!nodes.some(node => node.id === nodeId)) {
73 |                 nodes.push({id: nodeId, label: nodeId});
74 |             }
75 |         }
76 | 
77 |         // Initial call to update connections based on checkbox state
78 |         updateConnections();
79 |     </script>
80 | {% endblock %}
81 | 


--------------------------------------------------------------------------------