Advanced Topics

• 1: LDAP Authentication
• 2: Permissions in Vulnman
• 3: Custom Report Templates
• 4: Vulnerability Templates

1 - LDAP Authentication

In the first step, you need to install django-auth-ldap. This can be done with pip.

pip install django-auth-ldap

Settings

Add the following lines to your local_settings.py file.

##############
# LDAP
# You need to install `django-auth-ldap` to use LDAP authentication
# See https://django-auth-ldap.readthedocs.io/en/latest/install.html for library usage
##############

import ldap
from django_auth_ldap.config import LDAPSearch, PosixGroupType

AUTH_LDAP_BIND_DN = "cn=admin,dc=example,dc=org"
AUTH_LDAP_BIND_PASSWORD = "admin"
AUTH_LDAP_USER_SEARCH = LDAPSearch(
    "ou=Users,dc=example,dc=org", ldap.SCOPE_SUBTREE, "(uid=%(user)s)"
)

AUTH_LDAP_FIND_GROUP_PERMS = True
AUTH_LDAP_CACHE_TIMEOUT = 3600
AUTH_LDAP_SERVER_URI = "ldap://172.17.0.2"

AUTH_LDAP_GROUP_TYPE = PosixGroupType(name_attr='cn')
AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
    'ou=Groups,dc=example,dc=org',
    ldap.SCOPE_SUBTREE,
    '(objectClass=posixGroup)',
)

AUTH_LDAP_USER_ATTR_MAP = {
    "first_name": "givenName", "last_name": "sn",
    "email": "mail"
}

2 - Permissions in Vulnman

Vulnman comes with the following default roles and permission levels:

Roles

Pentesters

The members of the pentester group can be added to different projects. This will add permissions to the user to change, delete and view the project and its assets. Pentesters do not have permissions to add contributors to projects (except of the project creator). Pentesters are allowed to create new clients and create and invite their employees.

Vendors

A vendor is allowed to use the Responsible Disclosure application. The vendor is allowed to comment on shared vulnerabilities.

Customers

Customers are low privilged users. They can be added to projects.

Bughunters

Bughunters only have permissions to access the Responsible Disclosure application and manage vulnerabilities there. No permissions to projects are granted.

Project Contributor Roles

If a new contributor is added to a project the following roles are available.

Read Only

Contributors of this role are not allowed to change assets or other stuff belonging to the project.

Pentester

Pentesters are allowed to edit project related objects.

3 - Custom Report Templates

You can deploy your own report templates using a python package.

The default templates repository contains a full example of the layout of such a package. It should be noted, that the default report template is quite minimalistic, because you may use a custom one anyway.

Enable Report Template

To enable to the report template, add the following lines to your local_settings.py file.

# Report Templates
REPORT_TEMPLATES = {
    "default": 'vulnman_default_templates.report_templates.default_template',
    "my_report": 'my_package.report_templates.my_report'
}


ADDITIONAL_PACKAGES = [
    "my_package"
]

The setting above enables both, the default template and your custom one.

Stylesheets

The report generator will automatically check the existence of the scss/main.scss file in the report’s template directory. If this file exists, the stylesheets are automatically used in your report template.

Template Context

You have the full power of the django templating engine in your report template.

Translations

Translation files are located in locale directory.

To create the required text files, run the following command:

django-admin makemessages -l de -i "venv*" -i "build*" -i "dist*" -i "my_package.egg-info*"

Replace de with your language code. You can now edit the django.po file. If you are done, you need to run the following command:

django-admin compilemessages

4 - Vulnerability Templates

The Vulnman server relies on the existing vulnerability templates.

Since my current focus is on the core modules, the current templates are minimalistic and rather unsuitable for meaningful reports.

Feel free to contribute new vulnerability templates or improve existing ones.

Currently there is little to consider, and the creation is very simple.

Structure of Vulnerability Templates

First of all, the default community vulnerability templates repository is located here.

There are 3 required files for a vulnerability template:

• info.yaml: Contains meta data information of the template
• description.md: A description of the vulnerability written in markdown syntax
• resolution.md: A recommendation of how the vulnerability can be fixed. Also supports markdown syntax.

Vulnman supports multiple languages for report creation. This requires to have vulnerability templates in these languages.

The directory structure of a vulnerability template looks similar to the one below:

| - my_vulnerability
  | - info.yaml
  | - locale
    | - en
      | - description.md
      | - recommendation.md
    | - de
      | - description.md
      | - recommendation.md

info.yaml template

- id: cross-site-scripting
  name: Cross-Site Scripting
  severity: critical
  references:
    - "https://owasp.org/www-community/attacks/xss/"
  cwe:
    - CWE-79
  categories:
    - input-validation
  locale:
    en:
      name: Cross-Site Scripting
    de:
      name: Cross-Site Scripting