Welcome to purpleteam Discussions!

[binarymist]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[avarama]

I'm trying to install the local version of purpleteam (using app-scanner and orchestrator). I cannot get passed npm run dc-build. There's dependency hell between node, npm, python, docker-compose, docker-py and docker. Where do I get the actual versions of all those building tools that get me to an image from your source code?

[avarama]

SUCCESS.

Finally could build it by moving all the files, the ~/.nvm and ~/.npm and the nvm loader from root to a regular user, and adding that regular user to sudo and docker groups. All within the lxd container I needed to do the npm run dc-build

[binarymist]

I use node 14 and the npm that is shipped with that for running the CLI. If you have a recent install of Docker and docker-compose, the rest should be encapsulated within the Docker images which the npm run dc-build npm script builds.

Running as root is not required.

I've never had to add the regular user to sudo, just to the docker group as per install details of Docker (this is a Docker thing), not specific to PurpleTeam.

Shout out if and when you run into other problems, also let us know what went well, we'll do our best to help, and thanks for letting us know that you got the build working.

[binarymist]

Troubleshooting the above error... produced when running npm run dc-build is often best done by:

You can test this command https://github.com/purpleteam-labs/purpleteam-orchestrator/blob/main/package.json#L23 by running the following command in your terminal within the orchestrator's root dir: GROUP_ID=$(id -g) USER_ID=$(id -u) docker-compose -f ./compose/orchestrator-testers-compose.yml config

[avarama]

Everything seems to be working correctly. Where do I find the syntax and meaning of the Job JSON definitions? One problem I had is that data.attributes.sutAuthentication.route doesn't allow for more than ones slash, and in my case it is /portalName/Login.

✖  critical   [apiDecoratingAdapter] Error occurred while attempting to communicate with the purpleteam API. Error was: Invalid syntax in "Job" sent to the purpleteam API. Details follow:
[
  {
    "instancePath": "/data/attributes/sutAuthentication/route",
    "schemaPath": "#/definitions/SutAuthentication/properties/route/pattern",
    "keyword": "pattern",
    "params": {
      "pattern": "^/\\w{1,200}$"
    },
    "message": "must match pattern \"^/\\w{1,200}$\""
  }
]

[binarymist]

Currently the only documentation around the Job file would be the Job file examples and the schema. The line I've linked to needs it's regex tweaking for your use case. Want to submit a Pull Request? If there are other parts of the Job file that aren't making sense, let us know.

[avarama]

Hello. Is there a simple way to dump the HTML code in the current page at the time of an error? I have in my attackFields one particular field that is not being found. Checking the HTML would allow me to see if what failed was actually the navigation.

[binarymist]

Probably debugging/viewing what Selenium is doing in the browser would be the best option -> https://github.com/purpleteam-labs/purpleteam-s2-containers#viewing-browser-in-selenium-container

[avarama]

Does Purpleteam offer any kind of autodiscovery of pages and fields? So far in the examples I see that I need to manually specify each route and each attack field within that route. Is there any way to start a spider or similar scan?

[binarymist]

The pages (routes) you specify are spidered https://github.com/purpleteam-labs/purpleteam-app-scanner/blob/main/src/steps/app_scan_steps.js#L95

So the answer to your question is yes, but if you want to be sure that your routes and fields are going to be tested, you should attempt to specify it.

[avarama]

Hi! I have a Bad Request (HTTP status 400) when I try to execute my job. The ZAP emissary logs say:

Parsing message body failed: Invalid JSON: <json>:1:0 Expected json literal but found u
username={%username%}&password={%password%}
^

My job file:

{
  "data": {
    "type": "BrowserApp",
    "attributes": {
      "version": "3.1.0-alpha.3",
      "sutAuthentication": {
        "sitesTreeSutAuthenticationPopulationStrategy": "FormStandard",
        "emissaryAuthenticationStrategy": "FormStandard",
        "route": "/Login",
        "usernameFieldLocater": "username",
        "passwordFieldLocater": "password",
        "submit": "login",
        "expectedPageSourceSuccess": "TIN_"
      },
      "sutIp": "[redacted]",
      "sutPort": 443,
      "sutProtocol": "https",
      "browser": "chrome",
      "loggedInIndicator": "<p>Found. Redirecting to <a href=\"\/dashboard\">\/dashboard<\/a><\/p>"
    },
    "relationships": {
      "data": [{
        "type": "appScanner",
        "id": "adminUser"
      }]
    }
  },
  "included": [
    {
      "type": "appScanner",
      "id": "adminUser",
      "attributes": {
        "sitesTreePopulationStrategy": "WebDriverStandard",
        "spiderStrategy": "Standard",
        "scannersStrategy": "BrowserAppStandard",
        "scanningStrategy": "BrowserAppStandard",
        "postScanningStrategy": "BrowserAppStandard",
        "reportingStrategy": "Standard",
        "username": "[redacted]",
        "password": "[redacted]"
      },
      "relationships": {
        "data": [{
          "type": "route",
          "id": "/#Settings/Personal/12"
        }]
      }
    },
    {
      "type": "route",
      "id": "/#Settings/Personal/12",
      "attributes": {
        "attackFields": [
          {"name": "job_name", "value": "assistant", "visible": true}
        ],
        "method": "POST",
        "submit": "button_Primary"
      }
    }
  ]
}

[avarama]

sounds like I'm honoring the job file syntax but the JSON sent to ZAP gets broken

[avarama]

More context on the ZAP log:

5019 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows you to spider and import OpenAPI (Swagger) definitions
5022 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing OpenAPI Automation Framework Integration
5024 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Passive Scan Rules
5024 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Adds the Quick Start panel for scanning and exploring applications
5026 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Add the option to use the Ajax Spider in the Quick Start scan
5026 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Launch browsers proxying through ZAP
5027 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Launch browsers proxying through ZAP
5027 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Easy way to replace strings in requests and responses
5030 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Report Generation
5032 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Report Generation Automation Integration
5044 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing The Retest add-on allows to verify the presence/absence of certain alerts.
5045 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionSaveRawHttpMessage
5045 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing ExtensionSaveXMLHttpMessage
5045 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing SOAP Automation Framework Integration
5051 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Ajax Spider Automation Framework Integration
5054 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Tips and Tricks
5054 [ZAP-daemon] INFO  org.parosproxy.paros.extension.ExtensionLoader - Initializing Allows to fuzz WebSocket messages.
5057 [ZAP-daemon] WARN  org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - No check for updates for over 3 month - add-ons may well be out of date
5132 [ZAP-daemon] INFO  org.zaproxy.addon.oast.services.callback.CallbackService - Started callback service on 0.0.0.0:38891
5135 [ZAP-daemon] INFO  org.zaproxy.zap.extension.dynssl.ExtensionDynSSL - Creating new root CA certificate
5889 [ZAP-daemon] INFO  org.zaproxy.zap.extension.dynssl.ExtensionDynSSL - New root CA certificate created
5891 [ZAP-daemon] INFO  org.zaproxy.zap.DaemonBootstrap - ZAP is now listening on 0.0.0.0:8080
6068 [ZAP-cfu] INFO  org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate - There is/are 20 newer addons
Parsing message body failed: Invalid JSON: <json>:1:0 Expected json literal but found u
username={%username%}&password={%password%}
^
45436 [ZAP-ProxyThread-21] WARN  org.parosproxy.paros.core.proxy.ProxyThread - Failed to read https://[redacted] within 20 seconds, check to see if the site is available and if so consider adjusting ZAP's read time out in the Connection options panel.