Restructure code: split features into separate files

2026-01-28 13:33:02 +01:00
parent fcd5378f51
commit de6dcf2b82
18 changed files with 646 additions and 629 deletions
@@ -0,0 +1,104 @@
+#import "@preview/diagraph:0.3.6"
+
+#import "../addons/cvss.typ"
+
+#let render(target: str, targetInSentence: str, testFocus: str, testObject: str, testScenario: str, recommendation: str, start: str, end: str, setup: str, nodes: str, scope: array) = {
+  [
+    = Management Summary
+
+    == Motivation
+
+    #target ordered Acme Security, LLC to perform a #testScenario penetration test onto a selected number of hosts in a live and productive environment.
+
+    This penetration test was conducted to proactively identify, assess, and validate the severity of security vulnerabilities within the defined scope of #targetInSentence, specifically those exploitable by #testFocus. Adversarial techniques to bypass controls, gain unauthorized access, and compromise critical assets were performed for this test scenario to determine the actual impact on confidentiality, integrity, and availability.
+
+    == Test Object
+
+    #testObject
+
+    == Test Methodology
+
+    The aim of the test was to uncover vulnerabilities and weaknesses of all kinds and chaining findings and vulnerabilities accordingly to gain a deep understanding of the audited hosts, following a security-in-depth approach. The tests were carried out in accordance with the MITRE ATT&CK Framework#footnote("https://attack.mitre.org").
+
+    The penetration test was performed as a #testScenario.
+
+    == Findings
+
+    The penetration test revealed #context([
+      #let num = cvss.riskCategoryStats.values().map(v => v.final()).sum()
+      #if num == 1 {
+        [ #num finding ]
+      } else {
+        [ #num findings ]
+      }
+    ]) which can be categorized by risk:
+
+    #table(
+      columns: (16.66%, 16.66%, 16.66%, 16.66%, 16.66%, 16.66%),
+      align: center,
+      [Critical], [High], [Medium], [Low], [None], [Other],
+      table.cell(context(cvss.riskCategoryStats.Critical.final()), fill: red, align: center),
+      table.cell(context(cvss.riskCategoryStats.High.final()), fill: orange, align: center),
+      table.cell(context(cvss.riskCategoryStats.Medium.final()), fill: yellow, align: center),
+      table.cell(context(cvss.riskCategoryStats.Low.final()), fill: lime, align: center),
+      table.cell(context(cvss.riskCategoryStats.None.final()), fill: white, align: center),
+      table.cell(context(cvss.riskCategoryStats.Other.final()), fill: gray, align: center),
+    )
+
+    == Recommendations & Next Steps
+
+    #recommendation
+
+    == Test Scope and Setup
+
+    #if start != "" {
+      if end != "" {
+        [ The test was conducted from #start to #end. ]
+      } else {
+        [ The test was conducted on #start. ]
+      }
+    }
+
+    #setup
+
+    The following scope was set for the penetration test:
+
+    #table(
+      columns: (25%, 50%, 25%),
+      align: center,
+      inset: 10pt,
+      table.cell(fill: color.linear-rgb(4.5%, 14.5%, 14.5%, 100))[*Type*],
+      table.cell(fill: color.linear-rgb(4.5%, 14.5%, 14.5%, 100))[*Value*],
+      table.cell(fill: color.linear-rgb(4.5%, 14.5%, 14.5%, 100))[*State*],
+      ..for (i, value) in scope.enumerate() {
+        (
+          table.cell(value.type),
+          table.cell(value.content),
+          if value.inScope {
+            table.cell("In scope", fill: lime, align: center)
+          } else {
+            table.cell("Out of scope", fill: gray, align: center)
+          }
+        )
+      }
+    )
+
+    #if nodes != "" {
+      [ From the perspective of the machine used for the penetration test, the network layout was seen as shown in the graph below. ]
+
+      figure(
+        diagraph.render("
+          digraph G {
+            rankdir=LR;
+            node [shape=rectangle];
+
+            " + nodes + "
+          }
+        "),
+        caption: [
+          Schematic graph showing the test objective network
+        ]
+      )
+    }
+  ]
+}