DefensePointSecurity / threat_note

DPS' Lightweight Investigation Notebook
Apache License 2.0
421 stars 97 forks source link

Network Indicator errors #76

Open nullprobe opened 8 years ago

nullprobe commented 8 years ago

After adding an IPv4 network indicator and clicking on it I get the following error :

screenshot004 The server log shows the following request :

/usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connectionpool.py:789: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html
  InsecureRequestWarning)
127.0.0.1 - - [14/Dec/2015 11:01:48] "GET /network/4/info HTTP/1.1" 200

Also an error when adding a network domain indicator :

screenshot005

/usr/local/lib/python2.7/dist-packages/requests/packages/urllib3/connectionpool.py:789: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html
  InsecureRequestWarning)
127.0.0.1 - - [14/Dec/2015 11:05:17] "GET /network/1/info HTTP/1.1" 200 -
brianwarehime commented 8 years ago

Sorry for the late response, is this still an issue since the latest changes? Thanks!

eopdyke commented 8 years ago

Might still be an issue: 15:08:50 web.1 | /Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/requests-2.6.0-py2.7.egg/requests/packages/urllib3/connectionpool.py:769: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html 15:08:50 web.1 | InsecureRequestWarning) 15:09:18 web.1 | [2016-01-26 15:09:18 -0800] [90975] [CRITICAL] WORKER TIMEOUT (pid:90978)

alxhrck commented 8 years ago

@eopdyke this is a message from one of the python libraries warning about unverified HTTPS requests, which could allow for SSL MitM. It shouldn't cause an issue with viewing indicator details. I noticed in your screen shots the URL is /network/4/info. That 4 should be an IP or domain. Make sure you're using the most recent version of threat_note.

Edit: Oops. I realize you are not the person who originally opened the issue.

eopdyke commented 8 years ago

@alxhrck Correct, downloaded yesterday and it looks like the most up to date version of threat_note.
After adding a domain indicator and clicking on it I am presented with the following error: screen shot 2016-01-27 at 9 35 43 am

MLubinski commented 8 years ago

Same issue here, currently getting a "'NoneType' object is not iterable" when clicking on an indicator.

MLubinski commented 8 years ago

Testing here, this appears only when the Shodan data source is checked.