Graph Visualization

Graph Visualization in OWASP Nettacker is a feature designed to provide a visual representation of network reconnaissance and penetration testing results. It transforms textual scan data into interactive diagrams, allowing users to map network structures, visualize host-service relationships, and track the activities of various modules across targeted assets.

This system is integrated into the reporting engine, enabling the generation of graphical maps when the user selects HTML output. The visualization helps in identifying sensitive information and network topography more intuitively than traditional tabular reports.
Sources: nettacker/locale/en.yaml, nettacker/web/static/index.html:148-154

Core Architecture and Engine

The graph visualization system follows a modular architecture where different "graph engines" can be used to render data. The engine is responsible for building the graph structure from scan results and outputting the necessary HTML and JavaScript components.

Graph Generation Workflow

When a scan is initiated with graph options, the system processes the scan events to build a tree-like or network structure. The engine identifies nodes (such as targets, modules, and found ports) and edges (relationships between these entities).

The workflow ensures that if the graph feature is requested, the output filename must end with .html or .htm to support the embedded visualization scripts.
Sources: nettacker/locale/en.yaml, nettacker/web/static/js/main.js:296-330

Supported Visualization Types

Nettacker supports multiple versions of graph engines, primarily based on the D3.js library. Users can select the specific graph style through the CLI or Web UI.

The d3_tree_v2_graph is often set as the default visualization type in the Web Interface.
Sources: nettacker/web/static/js/main.js:220-225, nettacker/lib/graph/d3_tree_v1/readme.md, nettacker/lib/graph/d3_tree_v2/readme.md

Web UI Integration

The Web Interface provides a dedicated section for selecting graph parameters before submitting a new scan. Users can choose from a list of available graph modules dynamically loaded by the engine.

User Interface Elements

• Graph Name Selection: A radio button list where users select the desired graph module (e.g., d3_tree_v2_graph).
• Reporting Language: Affects the labels and descriptions within the generated graph report.
• Output Filename: Users must specify an .html file path to trigger graph generation.

Implementation Details

The implementation relies on external libraries, specifically jQuery and D3.js, to handle DOM manipulation and vector graphics rendering.

Key Libraries and Licenses

The graph modules include specific third-party components to support visualization:

• D3.js: Used for creating data-driven documents (BSD 3-Clause License).
• jQuery: Used for event handling and simplified DOM access (MIT License).
• Highlight.js & Showdown: Occasionally used for formatting internal readme/documentation for the graph modules.
  Sources: nettacker/lib/graph/d3_tree_v1/readme.md, nettacker/web/static/index.html:20-25

Data Handling

When generating the graph, the engine processes event data which includes:

• Target: The primary node (e.g., IP address or Domain).
• Module Name: The scanning module used (e.g., port_scan).
• Event/Condition Results: Specific findings like open ports or identified vulnerabilities that form the leaf nodes of the graph.
  Sources: nettacker/web/static/js/main.js:580-605

Conclusion

Graph Visualization is a critical component of OWASP Nettacker's reporting suite, providing a hierarchical and interactive view of security scan data. By leveraging D3.js, it translates complex scan results into a navigable map, facilitating better understanding of an organization's attack surface. Users must ensure HTML output is selected and appropriate graph modules are enabled to utilize this feature.
Sources: nettacker/locale/en.yaml, nettacker/lib/graph/readme.md