package attackgraph
import (
"encoding/json"
"fmt"
"sort"
"strings"
)
// palette (matches banner/hero.svg)
const (
colVoid = "#0B0E14"
colCyan = "#57C7FF"
colPurple = "#7F77DD"
colAmber = "#F5A623"
colGreen = "#3DDC97"
colRed = "#ff6b6b"
colWhite = "#E6E9EF"
colMuted = "#5C6577"
)
func nodeColor(t NodeType) string {
switch t {
case NodeEntry:
return colCyan
case NodeEndpoint, NodeAsset:
return colPurple
case NodeToken, NodeSecret:
return colAmber
case NodeObjectRef:
return colAmber
case NodeIdentity:
return colGreen
case NodeCapability:
return colRed
case NodeObjective:
return colAmber
}
return colMuted
}
func esc(s string) string {
s = strings.ReplaceAll(s, "&", "&")
s = strings.ReplaceAll(s, "<", "<")
s = strings.ReplaceAll(s, ">", ">")
return s
}
// GraphJSON is the serializable shape the web dashboard consumes.
type GraphJSON struct {
Nodes []nodeJSON `json:"nodes"`
Edges []edgeJSON `json:"edges"`
Path []string `json:"path"` // ordered node ids of the most-likely route
Prob float64 `json:"probability"`
}
type nodeJSON struct {
ID, Type, Label string
OnPath bool `json:"on_path"`
}
type edgeJSON struct {
From, To, Type, Detail string
Exploitability float64
OnPath bool `json:"on_path"`
}
// ToJSON serialises the graph + the most-likely path to the objective, for the
// dashboard / programmatic consumers.
func (g *Graph) ToJSON() []byte {
_, path, prob := g.BestPathToObjective(objectiveID)
onEdge, onNode := pathSets(path)
out := GraphJSON{Prob: prob}
for _, n := range g.AllNodes() {
out.Nodes = append(out.Nodes, nodeJSON{ID: n.ID, Type: string(n.Type), Label: n.Label, OnPath: onNode[n.ID]})
}
for _, e := range g.Edges() {
out.Edges = append(out.Edges, edgeJSON{From: e.From, To: e.To, Type: string(e.Type), Detail: e.Detail, Exploitability: e.Exploitability, OnPath: onEdge[edgeKey(e)]})
}
if len(path) > 0 {
out.Path = append(out.Path, path[0].From)
for _, e := range path {
out.Path = append(out.Path, e.To)
}
}
b, _ := json.MarshalIndent(out, "", " ")
return b
}
func edgeKey(e Edge) string { return e.From + "|" + e.To + "|" + string(e.Type) }
func pathSets(path []Edge) (edges map[string]bool, nodes map[string]bool) {
edges, nodes = map[string]bool{}, map[string]bool{}
for _, e := range path {
edges[edgeKey(e)] = true
nodes[e.From] = true
nodes[e.To] = true
}
return
}
// RenderHTML produces a self-contained, interactive attack-map page: a
// left-to-right layered layout of the graph with the most-likely path to the
// objective highlighted. title names the page (e.g. the target).
func (g *Graph) RenderHTML(title string) []byte {
const nodeW, nodeH, xStep, rowGap = 176.0, 56.0, 250.0, 92.0
const marginL, marginTop = 70.0, 110.0
layer := g.LayerFromEntry()
// group node ids by layer
byLayer := map[int][]string{}
maxLayer := 0
for _, n := range g.AllNodes() {
l := layer[n.ID]
byLayer[l] = append(byLayer[l], n.ID)
if l > maxLayer {
maxLayer = l
}
}
maxInLayer := 1
for _, ids := range byLayer {
if len(ids) > maxInLayer {
maxInLayer = len(ids)
}
}
width := marginL*2 + float64(maxLayer)*xStep + nodeW
height := marginTop + float64(maxInLayer)*rowGap + 90
centerY := marginTop + (height-marginTop)/2
// positions
type pos struct{ x, y float64 }
P := map[string]pos{}
for l := 0; l <= maxLayer; l++ {
ids := byLayer[l]
sort.Strings(ids)
n := len(ids)
for i, id := range ids {
x := marginL + float64(l)*xStep
y := centerY + (float64(i)-float64(n-1)/2)*rowGap - nodeH/2
P[id] = pos{x, y}
}
}
_, path, prob := g.BestPathToObjective(objectiveID)
onEdge, onNode := pathSets(path)
var b strings.Builder
fmt.Fprintf(&b, `%s — attack map
`)
return []byte(b.String())
}
func clip(s string, n int) string {
if len(s) <= n {
return s
}
return s[:n-1] + "…"
}