Change name in HTML output file to "webapp"

- Update some minor API things to not use deprecated features

.gitignore

@@ -119,3 +119,4 @@ results.html
 !tests/models/*
 !tests/data/*
 !docs/*
+logs/*

README.md

@@ -10,14 +10,26 @@ Eyeballer is meant for large-scope network penetration tests where you need to f
 | ------ |:-----:|
 | ![Sample Old-looking Page](/docs/old-looking.png) | ![Sample Login Page](/docs/login.png) |
 
-| Homepages | Custom 404's |
+| Webapp | Custom 404's |
 | ------ |:-----:|
-| ![Sample Homepage](/docs/homepage.png) | ![Sample Custom 404](/docs/404.png) |
+| ![Sample Webapp](/docs/homepage.png) | ![Sample Custom 404](/docs/404.png) |
+
+## What the Labels Mean
+
+**Old-Looking Sites**
+Blocky frames, broken CSS, that certain "je ne sais quoi" of a website that looks like it was designed in the early 2000's. You know it when you see it. Old websites aren't just ugly, they're also typically super vulnerable. When you're looking to hack into something, these websites are a gold mine.
+
+**Login Pages**
+Login pages are valuable to pen testing, they indicate that there's additional functionality you don't currently have access to. It also means there's a simple follow-up process of credential enumeration attacks. You might think that you can set a simple heuristic to find login pages, but in practice it's really hard. Modern sites don't just use a simple input tag we can grep for.
+
+**Webapp**
+This tells you that there is a larger group of pages and functionality available here that can serve as surface area to attack. This is in contrast to a simple login page, with no other functionality. Or a default IIS landing page which has no other functionality. This label should indicate to you that there is a web application here to attack.
+
+**Custom 404**
+Modern sites love to have cutesy custom 404 pages with pictures of broken robots or sad looking dogs. Unfortunately, they also love to return HTTP 200 response codes while they do it. More often, the "404" page doesn't even contain the text "404" in it. These pages are typically uninteresting, despite having a lot going on visually, and Eyeballer can help you sift them out.
 
 ## Setup
 
-Eyeballer uses TF.keras on Tensorflow 2.0. This is (as of this moment) still in "beta". So the pip requirement for it looks a bit weird. It'll also probably conflict with an existing TensorFlow installation if you've got the regular 1.0 version installed. So, heads-up there. But 2.0 should be out of beta and official "soon" according to Google, so this problem ought to solve itself in short order.
-
 Download required packages on pip:
 ```
 sudo pip3 install -r requirements.txt

eyeballer.py

@@ -54,7 +54,7 @@ def predict(ctx, screenshot, heatmap, threshold):
         print(results)
     else:
         with open("results.csv", "w", newline="") as csvfile:
-            fieldnames = ["filename", "custom404", "login", "homepage", "oldlooking"]
+            fieldnames = ["filename", "custom404", "login", "webapp", "oldlooking"]
             labelwriter = csv.DictWriter(csvfile, fieldnames=fieldnames)
             labelwriter.writeheader()
             labelwriter.writerows(results)

eyeballer/model.py

@@ -17,7 +17,7 @@ from tensorflow.keras.applications.mobilenet import preprocess_input
 from sklearn.metrics import classification_report, accuracy_score, hamming_loss
 from eyeballer.augmentation import EyeballerAugmentation
 
-DATA_LABELS = ["custom404", "login", "homepage", "oldlooking"]
+DATA_LABELS = ["custom404", "login", "webapp", "oldlooking"]
 
 
 class EyeballModel:
@@ -54,30 +54,6 @@ class EyeballModel:
                            loss="binary_crossentropy",
                            metrics=["accuracy"])
 
-        # for layer in pretrained_layer.layers:
-        #     layer.trainable = False
-
-        if print_summary:
-            print(self.model.summary())
-
-        self.quiet = quiet
-
-        # Pull out our labels for use in generators later
-        data = pd.read_csv("labels.csv")
-        self.training_labels = data.loc[data['evaluation'] == False]  # noqa: E712
-        self.evaluation_labels = data.loc[data['evaluation'] == True]  # noqa: E712
-
-        # Shuffle the training labels
-        self.random_seed = False
-        self.seed = seed
-        if self.seed is None:
-            self.random_seed = True
-            self.seed = random.randint(0, 999999)
-            print("No seed set, ", end='')
-        print("using seed: {}".format(self.seed))
-        random.seed(self.seed)
-        self.training_labels = self.training_labels.sample(frac=1)
-
         if weights_file is not None and os.path.isfile(weights_file):
             try:
                 self.model.load_weights(weights_file)
@@ -90,6 +66,28 @@ class EyeballModel:
                 raise FileNotFoundError
             print("WARN: No model loaded from file. Generating random model")
 
+        if print_summary:
+            print(self.model.summary())
+
+        self.quiet = quiet
+        self.seed = seed
+
+    def _init_labels(self):
+        # Pull out our labels for use in generators later
+        data = pd.read_csv("labels.csv")
+        self.training_labels = data.loc[data['evaluation'] == False]  # noqa: E712
+        self.evaluation_labels = data.loc[data['evaluation'] == True]  # noqa: E712
+
+        # Shuffle the training labels
+        self.random_seed = False
+        if self.seed is None:
+            self.random_seed = True
+            self.seed = random.randint(0, 999999)
+            print("No seed set, ", end='')
+        print("using seed: {}".format(self.seed))
+        random.seed(self.seed)
+        self.training_labels = self.training_labels.sample(frac=1)
+
         # Data augmentation
         augmentor = Augmentor.Pipeline()
         augmentor.set_seed(self.seed)
@@ -114,6 +112,7 @@ class EyeballModel:
         """
         print("Training with seed: " + str(self.seed))
 
+        self._init_labels()
         data_generator = tf.keras.preprocessing.image.ImageDataGenerator(
             preprocessing_function=self.preprocess_training_function,
             validation_split=0.2,
@@ -129,7 +128,7 @@ class EyeballModel:
             subset='training',
             shuffle=True,
             seed=self.seed,
-            class_mode="other")
+            class_mode="raw")
         validation_generator = data_generator.flow_from_dataframe(
             self.training_labels,
             directory=self.image_dir,
@@ -140,17 +139,26 @@ class EyeballModel:
             subset='validation',
             shuffle=False,
             seed=self.seed,
-            class_mode="other")
+            class_mode="raw")
 
         # Model checkpoint - Saves model weights when validation accuracy improves
         callbacks = [tf.keras.callbacks.ModelCheckpoint(self.checkpoint_file,
-                     monitor='val_loss',
-                     verbose=1,
-                     save_best_only=True,
-                     save_weights_only=True,
-                     mode='min')]
+                                                        monitor='val_loss',
+                                                        verbose=1,
+                                                        save_best_only=True,
+                                                        save_weights_only=True,
+                                                        mode='min'),
+                     tf.keras.callbacks.TensorBoard(log_dir='logs',
+                                                    histogram_freq=2,
+                                                    write_graph=True,
+                                                    write_images=False,
+                                                    update_freq='epoch',
+                                                    profile_batch=2,
+                                                    embeddings_freq=0,
+                                                    embeddings_metadata=None),
+                     ]
 
-        history = self.model.fit_generator(
+        history = self.model.fit(
             training_generator,
             steps_per_epoch=len(training_generator.filenames) // batch_size,
             epochs=epochs,
@@ -197,7 +205,7 @@ class EyeballModel:
         result["filename"] = "custom-image"
         result["custom404"] = prediction[0][0]
         result["login"] = prediction[0][1]
-        result["homepage"] = prediction[0][2]
+        result["webapp"] = prediction[0][2]
         result["oldlooking"] = prediction[0][3]
         return result
 
@@ -241,7 +249,7 @@ class EyeballModel:
             result["filename"] = screenshot
             result["custom404"] = prediction[0][0]
             result["login"] = prediction[0][1]
-            result["homepage"] = prediction[0][2]
+            result["webapp"] = prediction[0][2]
             result["oldlooking"] = prediction[0][3]
             results.append(result)
         return results
@@ -253,6 +261,7 @@ class EyeballModel:
         threshold -- Value between 0->1. The cutoff where the numerical prediction becomes boolean. Default: 0.5
         """
         # Prepare the data
+        self._init_labels()
         data_generator = tf.keras.preprocessing.image.ImageDataGenerator(
             preprocessing_function=preprocess_input)
         evaluation_generator = data_generator.flow_from_dataframe(
@@ -263,7 +272,7 @@ class EyeballModel:
             target_size=(self.image_width, self.image_height),
             shuffle=False,
             batch_size=1,
-            class_mode="other")
+            class_mode="raw")
         # If a seed was selected, then also evaluate on the validation set for that seed
         if not self.random_seed:
             print("Using validation set...")
@@ -282,11 +291,11 @@ class EyeballModel:
                 subset='validation',
                 shuffle=False,
                 seed=self.seed,
-                class_mode="other")
+                class_mode="raw")
         else:
             print("Using evaluation set...")
 
-        predictions = self.model.predict_generator(
+        predictions = self.model.predict(
             evaluation_generator,
             verbose=1,
             steps=len(evaluation_generator))

prediction_output_template.html

@@ -7,7 +7,7 @@
       <button class="btn all" onclick="filterSelection('all')"> Show all</button>
       <button class="btn" onclick="filterSelection('custom404')"> 404</button>
       <button class="btn" onclick="filterSelection('login')"> Login</button>
-      <button class="btn" onclick="filterSelection('homepage')"> Home Page</button>
+      <button class="btn" onclick="filterSelection('webapp')"> Web Application</button>
       <button class="btn" onclick="filterSelection('oldlooking')"> Old Looking</button>
         <select onchange="numOnPage=this.value; filterSelection([]);" style="float:right; margin:5px; margin-right:30px; height:30px; width:auto;">
           <option value="25">25</option>