{"id":3619,"date":"2014-04-15T01:13:54","date_gmt":"2014-04-14T17:13:54","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3619"},"modified":"2015-09-09T19:36:50","modified_gmt":"2015-09-09T11:36:50","slug":"kvasir-penetration-testing-data-management-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2014\/04\/kvasir-penetration-testing-data-management-tool\/","title":{"rendered":"Kvasir &#8211; Penetration Testing Data Management Tool"},"content":{"rendered":"<p>Penetration Testing Data Management can be a nightmware, because well you generate a LOT of data and some information when conducing a penetration test, especially using tools &#8211; they return lots of actual and potential vulnerabilitites to review. Port scanners can return thousands of ports for just a few hosts. How easy is it to share all this data with your co-workers?<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/farm8.staticflickr.com\/7042\/13852176954_0ebfed3fe5.jpg\" alt=\"Kvasir - Penetration Testing Data Management Tool\" \/><\/p>\n<p><strong>Features<\/strong><\/p>\n<p>That&#8217;s what Kvasir is here to help you with. Here&#8217;s what you&#8217;ll need to get started:<\/p>\n<ul>\n<li>The latest version of <a href=\"http:\/\/www.web2py.com\/\">web2py<\/a><\/li>\n<li>A database (PostgreSQL known to work)<\/li>\n<li>A network vulnerability scanner (Nexpose\/Nmap supported)<\/li>\n<li>Additional python libraries<\/li>\n<li>Kvasir is a web2py application and can be installed for each customer or task. <\/li>\n<\/ul>\n<p><strong>Tools Supported<\/strong><\/p>\n<p>At current release, Kvasir directly supports the following tools:<\/p>\n<ul>\n<li>Rapid7 Nexpose Vulnerability Scanner<\/li>\n<li><a href=\"https:\/\/www.darknet.org.uk\/2012\/05\/nmap-6-released-for-download-free-network-discovery-security-auditing-tool\/\">Nmap Security Scanner<\/a><\/li>\n<li>Metasploit Pro (limited support for Express\/Framework data)<\/li>\n<li>ShodanHQ<\/li>\n<li>ImmunitySec CANVAS<\/li>\n<li><a href=\"https:\/\/www.darknet.org.uk\/2013\/12\/thc-hydra-7-5-released-fast-parallel-network-logon-cracker\/\">THC-Hydra<\/a><\/li>\n<li>Foofus <a href=\"https:\/\/www.darknet.org.uk\/2010\/02\/medusa-2-0-released-parallel-network-login-brute-forcing-tool\/\">Medusa<\/a><\/li>\n<li><a href=\"https:\/\/www.darknet.org.uk\/2006\/03\/jtr-password-cracking-john-the-ripper-17-released-finally\/\">John The Ripper<\/a><\/li>\n<\/ul>\n<p>This design keeps data separated and from you accidentally attacking or reviewing other customers.<\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>This tool was developed primarily for the Cisco Systems Advanced Services Security Posture Assessment (SPA) team. While not every method used by the SPA team may directly relate we hope that this tool is something that can be molded and adapted to fit almost any working scenario.<\/p>\n<p><strong>Installation<\/strong><\/p>\n<p>Kvasir was primarily designed for use on short customer-focused engagements. A directory &#8216;application&#8217; for each customer would be used allowing for much stronger data separation.<\/p>\n<p>For example lets assume two customers, Foo Widgets and Bar Napkins.<\/p>\n<p>Data for each customer is stored in <code>\/opt\/data\/$CUSTOMERNAME<\/code><\/p>\n<p>Install Kvasir in each customer&#8217;s directory:<\/p>\n<pre class=\"lang:sh decode:true\">git clone https:\/\/github.com\/KvasirSecurity\/Kvasir \/opt\/data\/foowidgets\/kvasir\r\ngit clone https:\/\/github.com\/KvasirSecurity\/Kvasir \/opt\/data\/barnapkins\/kvasir<\/pre>\n<p>Now symbolically link Kvasir to the web2py application directory:<\/p>\n<pre class=\"lang:sh decode:true\">ln -s \/opt\/data\/foowidgets\/kvasir $WEB2PY_HOME\/applications\/foowdigets\r\nln -s \/opt\/data\/barnapkins\/kvasir $WEB2PY_HOME\/applications\/barnapkins<\/pre>\n<p>Create unique databases:<\/p>\n<pre class=\"lang:sh decode:true\">sudo su - postgres\r\ncreatedb -O pguser foowidgets\r\ncreatedb -O pguser barnapkins<\/pre>\n<p>Copy the kvasir.yaml.sample to kvasir.yaml and change the defaults:<\/p>\n<pre class=\"lang:sh decode:true\">db->kvasir->uri<\/pre>\n<p>Or read more <a href=\"https:\/\/github.com\/KvasirSecurity\/Kvasir\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Penetration Testing Data Management can be a nightmware, because well you generate a LOT of data and some information when conducing a penetration test, especially using tools &#8211; they return lots of actual and potential vulnerabilitites to review. Port scanners can return thousands of ports for just a few hosts. How easy is it to [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"Kvasir is a tool for Penetration Testing Data Management and will help you keep each customers information in order during an assessment.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1,11],"tags":[1047,56,47],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3619"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3619"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3619\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3619"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3619"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}