Split simple report generation, introduce `-jsonSimpleReport`

[laanwj]

Split generation of simple report into two passes.

• Pass one generates a SimpleReport structure from AnonymityReport
• Pass two generates either JSON or text to console

Add command-line option -jsonSimpleReport to specify generation of a JSON simple report.

-jsonReport output will also contain the simpleReport as one of the fields (I think this was the intention in #35).

Example output:

{
    "hiddenService": "4hwyik7xxwb6pbvb.onion",
    "risks": [
        {
            "severity": "low",
            "title": "Found IP Addresses",
            "description": "",
            "fix": "",
            "items": [
                "1.4.3.2"
            ]
        },
        {
            "severity": "high",
            "title": "Apache mod_status is enabled and accessible",
            "description": "Why this is bad: An attacker can gain very valuable information\nfrom this internal status page including IP addresses, co-hosted services and user activity.",
            "fix": "To fix, disable mod_status or serve it on a different port than the configured hidden service",
            "items": null
        },
        {
            "severity": "medium",
            "title": "Small number of images with EXIF metadata were discovered!",
            "description": "Why this is bad: EXIF metadata can itself deanonymize a user or\nservice operator (e.g. GPS location, Name etc.). Or, when combined, can be used to link anonymous identities together.",
            "fix": "To fix, re-encode all images to strip EXIF and other metadata.",
            "items": [
                "/sample1.jpg"
            ]
        },
        {
            "severity": "critical",
            "title": "Hidden service private key is accessible!",
            "description": "Why this is bad: This can be used to impersonate the service at any point in the future.",
            "fix": "To fix, generate a new hidden service and make sure the private_key file is not reachable from\nthe web root",
            "items": null
        }
    ]

Text output remains approximately the same:

--------------- OnionScan Report ---------------
Generating Report for: 4hwyik7xxwb6pbvb.onion

Low Risk: Found IP Addresses
         Items Identified:

         1.4.3.2

High Risk: Apache mod_status is enabled and accessible
         Why this is bad: An attacker can gain very valuable information
         from this internal status page including IP addresses, co-hosted services and user activity.
         To fix, disable mod_status or serve it on a different port than the configured hidden service

Medium Risk: Small number of images with EXIF metadata were discovered!
         Why this is bad: EXIF metadata can itself deanonymize a user or
         service operator (e.g. GPS location, Name etc.). Or, when combined, can be used to link anonymous identities together.
         To fix, re-encode all images to strip EXIF and other metadata.
         Items Identified:

         /sample1.jpg

Critical Risk: Hidden service private key is accessible!
         Why this is bad: This can be used to impersonate the service at any point in the future.
         To fix, generate a new hidden service and make sure the private_key file is not reachable from
         the web root

[laanwj]

Updated:

• Added SEV_INFO for info-only "risks" (the lists of email addresses, IP addresses, analytics IDs, bitcoin addresses)
• Add a formatting function (and tests) under utils, and use this to format the report to terminal width instead of hard-coding formatting
• Split up SimpleReport checks. Instead of having one huge function that does all checks, have a SimpleReportCheck interface which is implemented by every check. This is more extensible - plugins can call RegisterSimpleReportCheck to register their own checks on top of the standard ones.
• Print a message when no risks were found, instead of just ending the report.

Oh uh. Apparently I broke Travis in the process. I don't understand why: both the tests and gofmt pass locally. It appears some problem with fetching dependencies.

After this is complete (and passes Travis) I'll squash the commits into one, at least if you prefer it like that.

[s-rah]

This looks great! I think the reason Travis fails is because the actual FormatParagraph function doesn't seem to be in the commit - unless I've missed something.

[laanwj]

Oh, that'd explain a few things :) Re-trying with actually adding that file.

Edit: that did it