lair

README

go-lair

Documentation

Index

• Constants
• type AuthInterface
• type Command
• type Credential
• type File
• type Host
• type IdentifiedBy
• type Issue
• type IssueHost
• type IssueReference
• type Netblock
• type Note
• type OS
• type Person
• type PersonReference
• type PluginID
• type Project
• type Service
• type Version
• type WebDirectory

Constants

const (
	StatusGrey   = "lair-grey"
	StatusBlue   = "lair-blue"
	StatusGreen  = "lair-green"
	StatusOrange = "lair-orange"
	StatusRed    = "lair-red"
)

Status colors for hosts, ports, and vulnerabilities.

Types

type AuthInterface

type AuthInterface struct {
	ID            string `json:"_id" bson:"_id"`
	ProjectID     string `json:"projectId" bson:"projectId"`
	IsMultifactor bool   `json:"isMultifactor" bson:"isMultifactor"`
	Kind          string `json:"kind" bson:"kind"`
	URL           string `json:"url" bson:"url"`
	Description   string `json:"description" bson:"description"`
}

AuthInterface is a resource which exposes some functionality and is protected by some form of authentication. For example a Cisco SSL VPN.

type Command

type Command struct {
	Tool    string `json:"tool" bson:"tool"`
	Command string `json:"command" bson:"command"`
}

Command is used to track tool commands that were run.

type Credential

type Credential struct {
	ID        string `json:"_id" bson:"_id"`
	ProjectID string `json:"projectId" bson:"projectId"`
	Username  string `json:"username" bson:"username"`
	Password  string `json:"password" bson:"password"`
	Format    string `json:"format" bson:"format"`
	Hash      string `json:"hash" bson:"hash"`
	Host      string `json:"host" bson:"host"`
	Service   string `json:"service" bson:"service"`
}

Credential is some representation of a password All or none of the fields may be populated. Host and Service may be used to created loose relationships to host by ip and/or port. Username can be used to create a loose relationship to a person by principal name.

type File

type File struct {
	FileName string `json:"fileName" bson:"fileName"`
	URL      string `json:"url" bson:"url"`
}

File is used to share links to files for a project.

type Host

type Host struct {
	ID             string         `json:"_id" bson:"_id"`
	ProjectID      string         `json:"projectId" bson:"projectId"`
	LongIPv4Addr   uint64         `json:"longIpv4Addr" bson:"longIpv4Addr"`
	IPv4           string         `json:"ipv4" bson:"ipv4"`
	MAC            string         `json:"mac" bson:"mac"`
	Hostnames      []string       `json:"hostnames" bson:"hostnames"`
	OS             OS             `json:"os" bson:"os"`
	Notes          []Note         `json:"notes" bson:"notes"`
	StatusMessage  string         `json:"statusMessage" bson:"statusMessage"`
	Tags           []string       `json:"tags" bson:"tags"`
	Status         string         `json:"status" bson:"status"`
	LastModifiedBy string         `json:"lastModifiedBy" bson:"lastModifiedBy"`
	IsFlagged      bool           `json:"isFlagged" bson:"isFlagged"`
	Files          []File         `json:"files" bson:"files"`
	WebDirectories []WebDirectory `json:"webDirectories"`
	Services       []Service      `json:"services"`
}

Host is a single Lair host.

type IdentifiedBy

type IdentifiedBy struct {
	Tool string `json:"tool"`
}

IdentifiedBy is used to show what identfied the issue.

type Issue

type Issue struct {
	ID             string           `json:"_id" bson:"_id"`
	ProjectID      string           `json:"projectId" bson:"projectId"`
	Title          string           `json:"title" bson:"title"`
	CVSS           float64          `json:"cvss" bson:"cvss"`
	Rating         string           `json:"rating" bson:"rating"`
	IsConfirmed    bool             `json:"isConfirmed" bson:"isConfirmed"`
	Description    string           `json:"description" bson:"description"`
	Evidence       string           `json:"evidence" bson:"evidence"`
	Solution       string           `json:"solution" bson:"solution"`
	Hosts          []IssueHost      `json:"hosts" bson:"hosts"`
	PluginIDs      []PluginID       `json:"pluginIds" bson:"pluginIds"`
	CVEs           []string         `json:"cves" bson:"cves"`
	References     []IssueReference `json:"references" bson:"references"`
	IdentifiedBy   []IdentifiedBy   `json:"identified_by" bson:"identifiedBy"`
	IsFlagged      bool             `json:"isFlagged" bson:"isFlagged"`
	Status         string           `json:"status" bson:"status"`
	LastModifiedBy string           `json:"lastModifiedBy "bson:"lastModifiedBy"`
	Notes          []Note           `json:"notes" bson:"notes"`
	Files          []File           `json:"files" bson:"files"`
}

Issue contains all the needed information for a single issue in a project.

type IssueHost

type IssueHost struct {
	IPv4     string `json:"ipv4" bson:"ipv4"`
	Port     int    `json:"port" bson:"port"`
	Protocol string `json:"protocol" bson:"protocol"`
}

IssueHost is a single host record for a issue.

type IssueReference

type IssueReference struct {
	Link string `json:"link" bson:"link"`
	Name string `json:"name" bson:"name"`
}

IssueReference is a 3rd party containing issue information

type Netblock

type Netblock struct {
	ID             string `json:"_id" bson:"_id"`
	ProjectID      string `json:"projectId" bson:"projectId"`
	ASN            string `json:"asn" bson:"asn"`
	ASNCountryCode string `json:"asnCountryCode" bson:"asnCountryCode"`
	ASNCIDR        string `json:"asnCidr" bson:"asnCidr"`
	ASNDate        string `json:"asnDate" bson:"asnDate"`
	ASNRegistry    string `json:"asnRegistry" bson:"asnRegistry"`
	CIDR           string `json:"cidr" bson:"cidr"`
	AbuseEmails    string `json:"abuseEmails" bson:"abuseEmails"`
	MiscEmails     string `json:"miscEmails" bson:"miscEmails"`
	TechEmails     string `json:"techEmails" bson:"techEmails"`
	Name           string `json:"name" bson:"name"`
	Address        string `json:"address" bson:"address"`
	City           string `json:"city" bson:"city"`
	State          string `json:"state" bson:"state"`
	Country        string `json:"country" bson:"country"`
	PostalCode     string `json:"postalCode" bson:"postalCode"`
	Created        string `json:"created" bson:"created"`
	Updated        string `json:"updated" bson:"updated"`
	Description    string `json:"description" bson:"description"`
	Handle         string `json:"handle" bson:"handle"`
}

Netblock is used to store Whois data.

type Note

type Note struct {
	Title          string `json:"title" bson:"title"`
	Content        string `json:"content" bson:"content"`
	LastModifiedBy string `json:"lastModifiedBy" bson:"lastModifiedBy"`
}

Note is used to hold information data about as project, host, or port.

type OS

type OS struct {
	Tool        string `json:"tool" bson:"tool"`
	Weight      int    `json:"weight" bson:"weight"`
	Fingerprint string `json:"fingerprint" bson:"fingerprint"`
}

OS fingerprint for a host.

type Person

type Person struct {
	ID                string            `json:"_id" bson:"_id"`
	ProjectID         string            `json:"projectId" bson:"projectId"`
	PrincipalName     string            `json:"principalName" bson:"principalName"`
	SAMAccountName    string            `json:"samAccountName" bson:"samAccountName"`
	DistinguishedName string            `json:"distinguishedName" bson:"distinguishedName"`
	FirstName         string            `json:"firstName" bson:"firstName"`
	MiddleName        string            `json:"middleName" bson:"middleName"`
	LastName          string            `json:"lastName" bson:"lastName"`
	DisplayName       string            `json:"displayName" bson:"displayName"`
	Department        string            `json:"department" bson:"department"`
	Description       string            `json:"description" bson:"description"`
	Address           string            `json:"address" bson:"address"`
	Emails            []string          `json:"emails" bson:"emails"`
	Phones            []string          `json:"phones" bson:"phones"`
	References        []PersonReference `json:"references" bson:"references"`
	Groups            []string          `json:"groups" bson:"groups"`
	LastLogon         string            `json:"lastLogon" bson:"lastLogon"`
	LastLogoff        string            `json:"lastLogoff" bson:"lastLogoff"`
	LoggedIn          []string          `json:"loggedIn" bson:"loggedIn"`
}

Person is used to store information related to a single person for a project. Most fields map to AD. LastloggedIn is used to create a loose relationship to a Host by ip.

type PersonReference

type PersonReference struct {
	Description string `json:"description" bson:"description"`
	Username    string `json:"username" bson:"username"`
	Link        string `json:"link" bson:"link"`
}

PersonReference is used to link a person to a 3rd party site.

type PluginID

type PluginID struct {
	Tool string `json:"tool" bson:"tool"`
	ID   string `json:"id" bson:"id"`
}

PluginID is used to store a id from an automated tool.

type Project

type Project struct {
	ID             string          `json:"_id" bson:"_id"`
	Name           string          `json:"name" bson:"name"`
	Industry       string          `json:"industry" bson:"industry"`
	CreatedAt      string          `json:"createdAt" bson:"createdAt"`
	Description    string          `json:"description" bson:"description"`
	Owner          string          `json:"owner" bson:"owner"`
	Contributors   []string        `json:"contributors" bson:"contributors"`
	Commands       []Command       `json:"commands" bson:"commands"`
	Notes          []Note          `json:"notes" bson:"notes"`
	DroneLog       []string        `json:"droneLog" bson:"droneLog"`
	Tool           string          `json:"tool"`
	Hosts          []Host          `json:"hosts"`
	Issues         []Issue         `json:"issues"`
	AuthInterfaces []AuthInterface `json:"authInterfaces"`
	Netblocks      []Netblock      `json:"netblocks"`
	People         []Person        `json:"people"`
	Credentials    []Credential    `json:"credentials"`
	Files          []File          `json:"files"`
}

Project is the root for all information pertaining to a Lair project.

type Service

type Service struct {
	ID             string `json:"_id" bson:"_id"`
	ProjectID      string `json:"projectId" bson:"projectId"`
	HostID         string `json:"hostId" bson:"hostId"`
	Port           int    `json:"port" bson:"port"`
	Protocol       string `json:"protocol" bson:"protocol"`
	Service        string `json:"service" bson:"service"`
	Product        string `json:"product" bson:"product"`
	Status         string `json:"status" bson:"status"`
	IsFlagged      bool   `json:"isFlagged" bson:"isFlagged"`
	LastModifiedBy string `json:"lastModifiedBy" bson:"lastModifiedBy"`
	Notes          []Note `json:"notes" bson:"notes"`
	Files          []File `json:"files" bson:"files"`
}

Service contains all the needed information for a single service.

type Version

type Version struct {
	Value string `json:"version" bson:"version"`
}

Version is the major version of the lair document schema.

type WebDirectory

type WebDirectory struct {
	ID             string `json:"_id" bson:"_id"`
	ProjectID      string `json:"projectId" bson:"projectId"`
	HostID         string `json:"hostId" bson:"hostId"`
	Path           string `json:"path" bson:"path"`
	Port           int    `json:"port" bson:"port"`
	ResponseCode   string `json:"responseCode" bson:"responseCode"`
	LastModifiedBy string `json:"lastModifiedBy" bson:"lastModifiedBy"`
	IsFlagged      bool   `json:"isFlagged" bson:"isFlagged"`
}

WebDirectory is a path from a web listener and is a child of a Host. Port is not a relationship to a Service.