Project goals:
Distribution of network reconnaissance workload
Data analysis and management
reconnaissance
data management
+---+ (raw) files
agent +--+--+ server |
| |
+-------------+ | +--------------+ | +-----------------+
| | | | | | | | plugin1..N
| agent |<--------->| scheduler |---------->| parser |
| | | | | | | |
+-------------+ | +--------------+ | +-----------------+
| ^ queue1..N | |
plugin1..N | | + |
| | \|/
| +--------------+ +-----------------+
| | | | |
| | planner |---------->| db/storage |
| | | | |
| +--------------+ +-----------------+
| ^
| |
| +-----------------+
| | |
| | visuals |
| | |
| +-----------------+
+
Agent provides communication and execution layer for plugins implementing various tools wrappers and supports fine-graned workload routing via capabilities metadata (DEPRECATED).
For list of currently available agent plugins see sner/plugin/*/agent.py
Scheduler provides workload configuration management and distribution with heatmap based rate-limiting scheduling.
Queue -- a list of targets and coresponding agent module and scheduling attributes container. Each module has a different config and target specification, see corresponding module implementation for details.
Job -- workload unit object, eg. assignment and output tuple. Job assignment features CIDR or regex targets exclusions based on configuration values.
Heatmap, Readynet -- internal structures for rate-limited target selection.
CLI helpers are available for IP ranges enumerations and queues/targets management.
Long-running daemon providing continuous orchestration of agents and output data processing in order to keep storage up-to-date with monitored networks reconnaissance data.
Storage is a main IP-centric database model and user interface heavily inspired by Metasploit framework PRO UI. Allows somewhat flexible data management including predefined aggregations and items tagging.
Tags are being evaluated in certain usecases:
i:anything
is ignored in vuln grouping (view and report generation).
Tag is used to differentiate availability of the vuln/service/host/note from
different scanning pivots (eg. i:via_externalnetwork, i:via_internalvpn), but
visibility is ignored during report aggregations.
report
, report:data
, info
are used to sort out issues already been processed
by operator during engagement. Can be used to filter out and get "to be processed"
vulns.
Parsers are used to parse and ingest agent output data or raw files to storage.
For list of currently available parser plugins see sner/plugin/*/parser.py
Dataminend view of product-version informations for corresponding endpoints.
(EXPERIMENTAL) CPE-CVE correlations dataminig view.
Visualization modules of configuration and storage.
Basic access to managed data.
(EXPERIMENTAL) Set of external services for data analysis.
apt-get -y install git make docker.io docker-compose
git clone https://github.com/snerstack/sner-monorepo.git /opt/sner
cd /opt/sner/docker
docker-compose up -d
# install
apt-get -y install git sudo make docker.io docker-compose nodejs npm screen
git clone https://github.com/snerstack/sner-monorepo.git /opt/sner
cd /opt/sner
git checkout devel
# frontend
cd /opt/sner/frontend
npm install
npm run test
npm run lint
# server
cd /opt/sner/server
make install
make install-dev
make install-db
. venv/bin/activate
make db
make coverage lint
make test-selenium
deactivate
# run devservers
cd /opt/sner
make devservers
# run local docker build
cd /opt/sner/docker
docker-compose up -d
sner_maintenance: True
)bin/server scheduler enumips 127.0.0.0/24 > targets1
bin/server scheduler rangetocidr 127.0.0.1 127.0.3.5 | bin/server scheduler enumips > targets2
bin/server scheduler queue-enqueue <queue.name> --file=targets
bin/agent --shutdown [PID]
<SNER_VAR>/scheduler/queue-<queue.id>
)bin/server storage import <parser name> <filename>
nmap -sL 192.168.2.0/24 -oA scan-dnsenum
bin/server storage import nmap scan-dnsenum.xml
bin/server scheduler enumips 192.0.2.0/24 | bin/server scheduler queue-enqueue 'sner servicedisco nmap'
bin/agent --debug
bin/server storage import nmap /var/lib/sner/scheduler/queue-<queue.id>/*
# template
nmap SCANTYPE TIMING OUTPUT TARGETS
# example
bin/server storage service-list --filter 'Service.port == 22' --short > targets
nmap \
-sV --version-intensity 4 -Pn \
--max-retries 3 --script-timeout 30m --max-hostgroup 1 --max-rate 1 --scan-delay 10 \
-oA output --reason \
-p T:22 -iL targets
# import data
bin/server storage import nmap output.xml
See scripts/
.