Web UI Dashboard
Relevant source files
The following files were used as context for generating this wiki page:
The Web UI Dashboard is a centralized graphical management interface for the OWASP Nettacker framework. It provides a user-friendly environment to configure complex scans, monitor reconnaissance activities, and analyze vulnerability reports. The dashboard interfaces with the Nettacker REST API to execute modules across various protocols including HTTP, SSH, FTP, and SMB.
The UI is built using HTML5, Bootstrap for responsive design, and AngularJS/jQuery for dynamic content handling. It is primarily accessible via port 5000 when running the Nettacker API server or through the provided Docker Compose environment.
Sources: README.md:90-100, nettacker/web/static/index.html:1-40
Authentication and Session Management
The dashboard implements an API-key-based authentication system. Before accessing scanning features, users must set a session by providing a valid API key. The UI handles session states via asynchronous requests to the backend.
Session Logic Flow
The following diagram illustrates how the frontend validates and maintains the user session.
The application uses specific endpoints for session lifecycle:
/session/check: Validates if the current browser session is authorized./session/set: Associates the provided API key with the browser session./session/kill: Destroys the current session upon logout.
Sources: nettacker/web/static/js/main.js:13-90, nettacker/web/static/index.html:70-110
Scan Configuration Engine
The "New Scan" module is divided into Basic and Advanced configurations, allowing users to customize every aspect of the engine's behavior.
Configuration Options
| Category | Component | Description |
|---|---|---|
| Targets | targets | Supports IPv4, CIDR blocks, domains, and URLs. |
| Methods | selected_modules | Selection of scan, brute force, or vulnerability modules. |
| Profiles | profiles | Pre-defined groups of modules (e.g., vulnerability, scan). |
| Engine | thread_per_host | Concurrent connections per target (Default: 100). |
| Network | socks_proxy | SOCKS proxy configuration for evasion. |
| Evasion | time_sleep | Delay between requests to bypass IDS/IPS. |
Sources: nettacker/web/static/index.html:140-250, nettacker/locale/en.yaml:50-80
Scan Submission Architecture
When a scan is submitted, main.js aggregates form data into a JSON object and sends a POST request to the /new/scan endpoint.
Results and Data Visualization
The Dashboard provides two primary views for historical data: Results and Crawler.
Results View
This view lists all completed scans chronologically. Each entry displays a unique scan_id, the date of execution, and buttons to export data.
- JSON Export: Retrieval via
/results/get_json?id={id}. - CSV Export: Retrieval via
/results/get_csv?id={id}. - HTML Report: Full interactive reports including D3.js tree graphs.
Crawler and Search
The Crawler allows users to filter results by specific hosts. It uses a paginated search interface to query the underlying SQLite/MySQL database.
Sources: nettacker/web/static/js/main.js:468-550, nettacker/web/static/index.html:280-340
Scan Comparison Module
The comparison feature enables "drift detection" between two distinct scans. This is useful for identifying new open ports, discovered subdomains, or resolved vulnerabilities over time.
Comparison Data Flow
The comparison report specifically highlights:
- New Targets Discovered: Items present in the latest scan but missing from the older one.
- Old Targets Not Detected: Items that disappeared in the latest scan.
- Scan Result Changes: Differences in scan types or port status.
Sources: nettacker/web/static/report/compare_report.html:130-180, nettacker/web/static/js/main.js:150-200
Technical Summary
The Web UI Dashboard transforms the complex CLI arguments of OWASP Nettacker into a structured workflow. By utilizing a modular frontend script (main.js) and a template-based HTML structure, it provides a consistent interface for both basic users and security architects performing large-scale network audits.
Sources: AGENTS.md:1-15, nettacker/web/static/index.html:1-50