Kvasir – Penetration Testing Data Management Tool


Penetration Testing Data Management can be a nightmware, because well you generate a LOT of data and some information when conducing a penetration test, especially using tools – they return lots of actual and potential vulnerabilitites to review. Port scanners can return thousands of ports for just a few hosts. How easy is it to share all this data with your co-workers?

Kvasir - Penetration Testing Data Management Tool

Features

That’s what Kvasir is here to help you with. Here’s what you’ll need to get started:

  • The latest version of web2py
  • A database (PostgreSQL known to work)
  • A network vulnerability scanner (Nexpose/Nmap supported)
  • Additional python libraries
  • Kvasir is a web2py application and can be installed for each customer or task.

Tools Supported

At current release, Kvasir directly supports the following tools:

This design keeps data separated and from you accidentally attacking or reviewing other customers.


This tool was developed primarily for the Cisco Systems Advanced Services Security Posture Assessment (SPA) team. While not every method used by the SPA team may directly relate we hope that this tool is something that can be molded and adapted to fit almost any working scenario.

Installation

Kvasir was primarily designed for use on short customer-focused engagements. A directory ‘application’ for each customer would be used allowing for much stronger data separation.

For example lets assume two customers, Foo Widgets and Bar Napkins.

Data for each customer is stored in /opt/data/$CUSTOMERNAME

Install Kvasir in each customer’s directory:

Now symbolically link Kvasir to the web2py application directory:

Create unique databases:

Copy the kvasir.yaml.sample to kvasir.yaml and change the defaults:

Or read more here.

Posted in: Hacking News, Security Software

, ,


Latest Posts:


Nipe - Make Tor Default Gateway For Network Nipe – Make Tor Default Gateway For Network
Nipe is a Perl script to make Tor default gateway for network, this script enables you to directly route all your traffic from your computer to the Tor network.
Mosca - Manual Static Analysis Tool To Find Bugs Mosca – Manual Static Analysis Tool To Find Bugs
Mosca is a manual static analysis tool written in C designed to find bugs in the code before it is compiled, much like a grep unix command.
Slurp - Amazon AWS S3 Bucket Enumerator Slurp – Amazon AWS S3 Bucket Enumerator
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan externally or an AWS API to scan internally.
US Government Cyber Security Still Inadequate US Government Cyber Security Still Inadequate
Surprise, surprise, surprise - an internal audit of the US Government cyber security situation has uncovered widespread weaknesses, legacy systems and poor adoption of cyber controls and tooling.
BloodHound - Hacking Active Directory Trust Relationships BloodHound – Hacking Active Directory Trust Relationships
BloodHound is for hacking active directory trust relationships and it uses graph theory to reveal the hidden and often unintended relationships within an AD environment.
SecLists - Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.


One Response to Kvasir – Penetration Testing Data Management Tool

  1. Dominick April 18, 2014 at 7:09 am #

    Sometimes when you get thousands of ports it can be confusing to everyone else but yourself. This tool you’re bringing to light seems to be a game changer! I hope this makes it easy to identify the more critical posts rather than having to siphon through thousands hoping there are a couple!