david-prv / overmind Goto Github PK

View Code? Open in Web Editor NEW

0.0 1.0 0.0 58.38 MB

A small framework to run open-source tools that inspect and scan any kind of webpages for vulnerabilities.

License: GNU General Public License v3.0

PHP 43.79% JavaScript 23.86% HTML 18.21% Python 10.86% CSS 3.28%

cybersecurity framework scanner security vulnerability-assessment vulnerability-detection vulnerability-scanners web

overmind's Introduction

Overmind
Control Framework

A small framework capable of running open-source vulnerability scanners to inspect and scan any kind of webpage

Disclaimer

This tool is not intended to be used for any criminal act. It's used to find vulnerabilites on websites whose owners have given me express permission to do so! You are responsible for all your decisions.

Roadmap

FIX final report layout
ADD sonar mode
ADD website auto-detection (selects e.g. "wordpress" automatically)
ADD more dependencies (components) for single pages
ADD customization option for engines (add own runners with corresponding requirements)
ADD json-import for engines
ADD AI-assistant for report analysis

Don't forget issues, that should be re-opened: label:willreopen

Requirements

Apache2
PHP (>= 8.2.0)
Python (>= 3.9.13)
Composer (>= 2.1.2)

Snapshot Structure

snapshot.zip/
├── _extra/
│   └── empty
├── _tools/
│   ├── sample
│   │   ├── sample.info
│   │   ├── sample.reference
│   │   ├── sample.schedule
│   │   └── sample.zip
│   └── sample2
│       ├── sample2.info
│       ├── sample2.reference
│       ├── sample2.schedule
│       └── sample2.zip
├── .author
└── .info

Installation

Clone repository:

git clone https://github.com/david-prv/overmind.git

Navigate into project's root folder:

cd overmind

Install dependencies:

composer install

Run compressor:

php compressor.php

Firing Up & Getting Started

This application is only meant to be running locally. It's not supposed to be a public accessible application in the web. To run a local instance, you can either use XAMPP to run a local web-server, or just launch a PHP development server.

# in project's root folder...
php -S localhost:8080

Now open a web browser and navigate to http://localhost:8080/. The Overmind framework should appear.

Information about what to do next will be provided here. For guests, check out the github wiki.

License

Released under GPL by @david-prv.

overmind's People

Contributors

Watchers

overmind's Issues

Interaction Mgr does not clear on tool removal

The scheduled inputs aren't removed when disintegrating a tool. This does not break the framework but may lead to issues for certain cases: assume the last deleted tool was interactive and also the last recently added tool (assume ID=7). Now, an user adds a new non-interactive tool to the framework. The scanner will eventually be assigned ID=7 (assuming that the topmost tool has ID=6). The interactions are still stored for ID=7, so, the framework may think that the newly integrated tool is interactive. This should not break the tool but may lead to confusions.

Integration Bot: Maximum execution time exceeded

Fatal error: Maximum execution time of 30 seconds exceeded in C:\Users\david\PhpstormProjects\scanner-bundle\app\utils\third-party\bot\functions.php on line 358

PHP8 broke schedules

Wanted format: {"0":["y"]}
What php json_encode does: [["y"]]

Compressor Exception

PHP Fatal error:  Uncaught Error: Call to undefined function MatthiasMullie\PathConverter\mb_substr() in C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\path-converter\src\Converter.php:192
Stack trace:
#0 C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\path-converter\src\Converter.php(53): MatthiasMullie\PathConverter\Converter->dirname('C:\\Users\\david\\...')
#1 C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\minify\src\CSS.php(777): MatthiasMullie\PathConverter\Converter->__construct('C:\\Users\\david\\...', 'C:\\Users\\david\\...')
#2 C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\minify\src\CSS.php(339): MatthiasMullie\Minify\CSS->getPathConverter('C:\\Users\\david\\...', 'C:\\Users\\david\\...')
#3 C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\minify\src\Minify.php(152): MatthiasMullie\Minify\CSS->execute('C:\\Users\\david\\...')
#4 C:\Users\david\PhpstormProjects\scanner-bundle\compressor.php(81): MatthiasMullie\Minify\Minify->minify('C:\\Users\\david\\...')
#5 {main}
  thrown in C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\path-converter\src\Converter.php on line 192

Fatal error: Uncaught Error: Call to undefined function MatthiasMullie\PathConverter\mb_substr() in C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\path-converter\src\Converter.php:192
Stack trace:
#0 C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\path-converter\src\Converter.php(53): MatthiasMullie\PathConverter\Converter->dirname('C:\\Users\\david\\...')
#1 C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\minify\src\CSS.php(777): MatthiasMullie\PathConverter\Converter->__construct('C:\\Users\\david\\...', 'C:\\Users\\david\\...')
#2 C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\minify\src\CSS.php(339): MatthiasMullie\Minify\CSS->getPathConverter('C:\\Users\\david\\...', 'C:\\Users\\david\\...')
#3 C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\minify\src\Minify.php(152): MatthiasMullie\Minify\CSS->execute('C:\\Users\\david\\...')
#4 C:\Users\david\PhpstormProjects\scanner-bundle\compressor.php(81): MatthiasMullie\Minify\Minify->minify('C:\\Users\\david\\...')
#5 {main}
  thrown in C:\Users\david\PhpstormProjects\scanner-bundle\vendor\matthiasmullie\path-converter\src\Converter.php on line 192

PHP: v8.2.0

Snapshot Creator Namespace Issue

When creating a snapshot from an instance that has a different name then its namespace, the snapshot creator will be confused and puts an empty zip archive into _tools/sample. Familiar with #7

Remove reference file too when deleting a tool

Reference files are not removed at all, when disintegrating a tool. This is has already been considered during the development of the integration bot as possible bug, which is handled as a warning. The framework should clean-up the reference files too, for the same reasons as mentioned here: #2

"No tools found" text does not show up

In some cases, the text "No tools found" does not show up after deleting all existing tools from the framework.
This is not a dealbreaker, but definitely a bug, most likely in bundle.min.js.

Tool namespace does not need to be the tool's name

Snapshots created from an instance, where a git project was purely integrated, contain faulty information by default. The name is usually set manually, which does not need to match the namespace necessarily. When integrating a snapshot containing such an issue leads to "breaking" (or rather confusing) the runner. It reports:

Could not open input file: ~/scanner-bundle-main/app/tools/Wordpress-scanner-master/app.php
The tool is called Wordpress-scanner in the wordpress-scanner.info file. That's why the namespace was automatically set to Wordpress-scanner/ instead of Wordpress-scanner-master/

You can launch the framework, even when unselecting all tools in pre-launch dialogue

Select tools, press launch selected, unselect all tools again at the modal bottom. Now launch. It will run forever.

Running alert is showing even if no tools integrated

read title - no more details