
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
csle-attack-profiler
Advanced tools
csle-attack-profiler
Scripts and programs to profile attacks, attack sequences, and a probabilistic HMM profiler using data from the csle platform, profiling attacks to MITRE ATT&CK techniques, and tactics.
[![PyPI version]] 0.5.1 ![PyPI - Downloads] (https://pypi.org/project/csle-attack-profiler/)
csle-common
csle-base
mitreattack-python
flake8
(for linting)flake8-rst-docstrings
(for linting docstrings)tox
(for automated testing)pytest
(for unit tests)pytest-cov
(for unit test coverage)mypy
(for static typing)mypy-extensions
(for static typing)mypy-protobuf
(for static typing)types-PyYaml
(for static typing)types-paramiko
(for static typing)types-protobuf
(for static typing)types-requests
(for static typing)types-urllib3
(for static typing)sphinx
(for API documentation)sphinxcontrib-napoleon
(for API documentation)sphinx-rtd-theme
(for API documentation)pytest-mock
(for mocking tests)pytest-grpc
(for grpc tests)# install from pip
pip install csle-attack-profiler==<version>
# local install from source
$ pip install -e csle-attack-profiler
# or (equivalently):
make install
# force upgrade deps
$ pip install -e csle-attack-profiler --upgrade
# git clone and install from source
git clone https://github.com/Limmen/csle
cd csle/simulation-system/libs/csle-attack-profiler
pip3 install -e .
# Install development dependencies
$ pip install -r requirements_dev.txt
Install all development tools at once:
make install_dev
or
pip install -r requirements_dev.txt
This section contains instructions for generating API documentation using sphinx
.
The latest documentation is available at https://limmen.dev/csle/docs/csle-attack-profiler
First make sure that the CSLE_HOME
environment variable is set:
echo $CSLE_HOME
Then generate the documentation with the commands:
cd docs
sphinx-apidoc -f -o source/ ../src/csle_attack_profiler/
make html
To update the official documentation at https://limmen.dev/csle, copy the generated HTML files to the documentation folder:
cp -r build/html ../../../../docs/_docs/csle-attack-profiler
To run all documentation commands at once, use the command:
make docs
To run the Python linter, execute the following command:
flake8 .
# or (equivalently):
make lint
To run the mypy type checker, execute the following command:
mypy .
# or (equivalently):
make types
To run the unit tests, execute the following command:
pytest
# or (equivalently):
make unit_tests
To run tests of a specific test suite, execute the following command:
pytest -k "ClassName"
To generate a coverage report, execute the following command:
pytest --cov=csle_attack_profiler
To run tests and code analysis in different python environments, execute the following command:
tox
# or (equivalently):
make tests
First build the package by executing:
python -m build
# or (equivalently)
make build
After running the command above, the built package is available at ./dist
.
Push the built package to PyPi by running:
python -m twine upload dist/*
# or (equivalently)
make push
To run all commands for the release at once, execute:
make release
Bength Pappila brpa@kth.se
Creative Commons
(C) 2024, Bength Pappila
FAQs
Library with MITRE attack profiler for CSLE
We found that csle-attack-profiler demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.