Compare commits

..
5 Commits
4 changed files with 11 additions and 11 deletions

No files matched your search

+6 -6
View File
@@ -14,9 +14,9 @@ Eyeballer is meant for large-scope network penetration tests where you need to f
| ------ |:-----:|
| ![Sample Old-looking Page](/docs/old-looking.png) | ![Sample Login Page](/docs/login.png) |
| Homepages | Custom 404's |
| Webapp | Custom 404's |
| ------ |:-----:|
| ![Sample Homepage](/docs/homepage.png) | ![Sample Custom 404](/docs/404.png) |
| ![Sample Webapp](/docs/homepage.png) | ![Sample Custom 404](/docs/404.png) |
## What the Labels Mean
@@ -26,8 +26,8 @@ Blocky frames, broken CSS, that certain "je ne sais quoi" of a website that look
**Login Pages**
Login pages are valuable to pen testing, they indicate that there's additional functionality you don't currently have access to. It also means there's a simple follow-up process of credential enumeration attacks. You might think that you can set a simple heuristic to find login pages, but in practice it's really hard. Modern sites don't just use a simple input tag we can grep for.
**Homepages**
A "Homepage" is the landing page to a larger application. This tells you that there is a larger group of pages and functionality available here that can serve as surface area to attack. This is in contrast to a simple login page, with no other functionality. Or a default IIS landing page which has no other functionality. A "Homepage" should indicate to you that there is a web application here to attack.
**Webapp**
This tells you that there is a larger group of pages and functionality available here that can serve as surface area to attack. This is in contrast to a simple login page, with no other functionality. Or a default IIS landing page which has no other functionality. This label should indicate to you that there is a web application here to attack.
**Custom 404**
Modern sites love to have cutesy custom 404 pages with pictures of broken robots or sad looking dogs. Unfortunately, they also love to return HTTP 200 response codes while they do it. More often, the "404" page doesn't even contain the text "404" in it. These pages are typically uninteresting, despite having a lot going on visually, and Eyeballer can help you sift them out.
@@ -48,13 +48,13 @@ sudo pip3 install -r requirements-gpu.txt
**Training Data** You can find our training data here:
https://www.dropbox.com/sh/7aouywaid7xptpq/AAD_-I4hAHrDeiosDAQksnBma?dl=1
https://www.dropbox.com/sh/usd03z9s0vnhzxu/AADyJvWgzlL1w4WnaAuxQbQQa?dl=1
Pretty soon, we're going to add this as a TensorFlow DataSet, so you don't need to download this separately like this. It'll also let us version the data a bit better. But for now, just deal with it. There's two things you need from the training data:
1. `images/` folder, containing all the screenshots (resized down to 224x140. We'll have the full-size images up soon)
2. `labels.csv` that has all the labels
3. `bishop-fox-pretrained-v1.h5` A pretrained weights file you can use right out of the box without training.
3. `bishop-fox-pretrained-v2.h5` A pretrained weights file you can use right out of the box without training.
Copy all three into the root of the Eyeballer code tree.
+1 -1
View File
@@ -54,7 +54,7 @@ def predict(ctx, screenshot, heatmap, threshold):
print(results)
else:
with open("results.csv", "w", newline="") as csvfile:
fieldnames = ["filename", "custom404", "login", "homepage", "oldlooking"]
fieldnames = ["filename", "custom404", "login", "webapp", "oldlooking"]
labelwriter = csv.DictWriter(csvfile, fieldnames=fieldnames)
labelwriter.writeheader()
labelwriter.writerows(results)
+3 -3
View File
@@ -17,7 +17,7 @@ from tensorflow.keras.applications.mobilenet import preprocess_input
from sklearn.metrics import classification_report, accuracy_score, hamming_loss
from eyeballer.augmentation import EyeballerAugmentation
DATA_LABELS = ["custom404", "login", "homepage", "oldlooking"]
DATA_LABELS = ["custom404", "login", "webapp", "oldlooking"]
class EyeballModel:
@@ -205,7 +205,7 @@ class EyeballModel:
result["filename"] = "custom-image"
result["custom404"] = prediction[0][0]
result["login"] = prediction[0][1]
result["homepage"] = prediction[0][2]
result["webapp"] = prediction[0][2]
result["oldlooking"] = prediction[0][3]
return result
@@ -249,7 +249,7 @@ class EyeballModel:
result["filename"] = screenshot
result["custom404"] = prediction[0][0]
result["login"] = prediction[0][1]
result["homepage"] = prediction[0][2]
result["webapp"] = prediction[0][2]
result["oldlooking"] = prediction[0][3]
results.append(result)
return results
+1 -1
View File
@@ -7,7 +7,7 @@
<button class="btn all" onclick="filterSelection('all')"> Show all</button>
<button class="btn" onclick="filterSelection('custom404')"> 404</button>
<button class="btn" onclick="filterSelection('login')"> Login</button>
<button class="btn" onclick="filterSelection('homepage')"> Home Page</button>
<button class="btn" onclick="filterSelection('webapp')"> Web Application</button>
<button class="btn" onclick="filterSelection('oldlooking')"> Old Looking</button>
<select onchange="numOnPage=this.value; filterSelection([]);" style="float:right; margin:5px; margin-right:30px; height:30px; width:auto;">
<option value="25">25</option>