Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Analysis tab remake and new custom query modal for interactive query creation #476

Merged
merged 3 commits into from
Jan 18, 2022

Conversation

Vulcanun
Copy link
Contributor

Category based query listing

Through the usage of the already existing CollapsibleSection elements, alteration of the PrebuiltQueryNode element, the creation of the new JSON query "category" value and rework of the "PrebuiltQueriesDisplay.jsx" code, my intention with this is to present the queries on an organized fashion, instead of the simple unformatted list it currently is. These allow users to encounter the queries they are searching for faster than before, as the new categories I've added to the prebuilt queries limit the "table" size where they have to look for it. Additionally, the usage of already existing JSX Elements like CollapsibleSection not only ties it down with the other tabs, creating a more uniform design, but also accounts for both light and dark themes.
Since this logic depends on an arbitrary categorization registered on the JSON query object, it can only occur whenever the "category" value is defined. If a query is created either on "customqueries.json" or "PrebuiltQueries.json" without a category, it will be displayed under the "Uncategorized Query" collapsible section - I thought about using only "Uncategorized", but it resembles JavaScript's undefined a bit too much and users might think it's broken code.

For the sake of demonstration, here's a before and after on the JSON object:

Before

{
	"name": "Find Principals with DCSync Rights",
	"queryList": [
               ...
	]
}

After

{
	"name": "Find Principals with DCSync Rights",
	"category": "Dangerous Rights",
	"queryList": [
               ...
	]
}

Here's how it looks now:

image

The category names are completely custom and simply have to be changed on the "PrebuiltQueries.json" if you guys feel like naming it something else or creating different categories altogether.


In-app create custom query

To incentivize users to explore the creation of custom queries in order to achieve new exploitation paths and advanced node filtering, I've created a floating form - similar to the settings modal - where a new query can be crafted interactively. This not only allows for real-time integrated testing, but also allows for a seamless interaction without having to leave the window.
This form is not intended to fulfill every custom query creation necessity, as it only accounts for simple single queries. Complex chained queries still require users to edit the JSON files manually.
Here's how it looks:

image

Fills unfilled form fields with "Unnamed query" as a name and "Uncategorized query" as category.
Fixed the new custom query category autocomplete suggestion field size so it fits on the modal and users can scroll through to find the right category.
@andyrobbins
Copy link
Contributor

Thank you for this AMAZING PR, @Vulcanun. I'll review this in-depth as soon as I can and provide feedback.

@aress31
Copy link

aress31 commented Aug 24, 2021

Exactly what I wanted to be implemented as I have been using circa 100s of custom queries for a while and having to search through them to find a single one is a pain in the back!

The idea of adding custom queries directly from BloodHound is brilliant too! Extending this feature to support chain queries would definitely be worth waiting for!

Important question though, does that support nested panels? For example I would like to see Shortest Path -> From Owned Nodes -> All the Queries or Shortest Path -> From a Specific Node -> All the Queries. Adding nested capabilities would really help clean up and organise the UI.

@Vulcanun
Copy link
Contributor Author

Hey there @aress31, it does not.
Right now it simply groups them based on a parameter, but I actually really like your idea.
I'm going to work on it and let you know if I get somewhere.

@aress31
Copy link

aress31 commented Aug 27, 2021

@Vulcanun, amazing! Looking forward to see the final results! 😇

@rvazarkar rvazarkar self-requested a review January 12, 2022 19:29
@rvazarkar rvazarkar changed the base branch from master to foss_vnext January 18, 2022 19:17
@rvazarkar rvazarkar changed the base branch from foss_vnext to master January 18, 2022 19:24
@rvazarkar rvazarkar changed the base branch from master to foss_vnext_prebuilt January 18, 2022 19:27
@rvazarkar rvazarkar merged commit 63fbb24 into SpecterOps:foss_vnext_prebuilt Jan 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants