results-storage

渗透测试结果存储与报告

概述

results-storage 技能提供基于 SQLite 的持久化存储系统，用于存储所有渗透测试活动的数据。它支持跨会话持久化数据、结构化漏洞跟踪和专业报告生成。

主要功能

• 持久化存储：SQLite 数据库位于 ./data/results.db
• 灵活组织：子系统（可选）> 主机层级
• 多格式报告：生成 Markdown 和 JSON 报告
• 查询功能：按严重性、类型、主机和子系统筛选
• 零破坏性变更：可与现有技能配合使用，无需修改

数据组织

Subsystem (optional)
    └── Host
        ├── Port Scan Results
        ├── Vulnerabilities (SQLi, XSS, LFI, etc.)
        └── Web Findings (detailed web vulnerability info)

不使用子系统：数据按扁平的主机层级组织（subsystem_id 为 NULL）

快速入门

初始化数据库

数据库会在首次使用时自动创建：

from .claude.skills.results-storage.scripts.storage_api import StorageAPI

api = StoreAPI()
# Database created at ./data/results.db

存储漏洞

# Flat hierarchy (no subsystem)
api.store_sqli_vulnerability(
    host_ip="192.168.1.100",
    url="https://example.com/login?id=1",
    parameter="id",
    payload="1' OR '1'='1",
    severity="Critical",
    title="SQL Injection in Login Page"
)

# With subsystem
api.store_xss_vulnerability(
    host_ip="192.168.1.100",
    url="https://example.com/search",
    xss_type="reflected",
    payload="<script>alert(1)</script>",
    subsystem="Web Application",
    severity="High",
    title="XSS in Search Functionality"
)

生成报告

from .claude.skills.results-storage.scripts.report_generator import ReportGenerator

gen = ReportGenerator()

# Markdown report
gen.generate_markdown_report(output_path="pentest_report.md")

# JSON report
gen.generate_json_report(output_path="pentest_report.json")

# Subsystem-specific report
gen.generate_markdown_report(
    output_path="webapp_report.md",
    subsystem="Web Application"
)

数据库架构

表

subsystems（可选）

• id、name、description、subnet_range、created_at

hosts

• id、subsystem_id（可为空）、ip_address、hostname、mac_address、os_fingerprint、status、first_seen、last_seen

vulnerabilities

• id、host_id、vulnerability_type、severity、title、description、affected_component、proof_of_concept、cvss_score、cwe_id、cve_id、status、discovered_at、discovered_by_skill

port_scan_results

• id、host_id、port、protocol、state、service、version、product、extra_info、scan_tool、scan_date

web_findings（详细的 Web 漏洞信息）

• id、vulnerability_id、url、parameter、http_method、payload、response_evidence、context、request_headers

scan_metadata

• id、host_id、skill_used、scan_command、scan_date、raw_output_path、notes

索引

针对常见查询进行了优化：

• idx_vulnerabilities_severity，位于 vulnerabilities(severity)
• idx_vulnerabilities_type，位于 vulnerabilities(vulnerability_type)
• idx_vulnerabilities_host，位于 vulnerabilities(host_id)
• idx_port_scans_host，位于 port_scan_results(host_id)
• idx_web_findings_vuln，位于 web_findings(vulnerability_id)

API 参考

StorageAPI 类

初始化

api = StorageAPI(db_path="./data/results.db")

子系统管理

# Create subsystem
subsystem_id = api.create_subsystem(
    name="Web Application",
    description="Customer A web infrastructure",
    subnet_range="192.168.1.0/24"
)

# Get or create (returns existing if already exists)
subsystem_id = api.get_or_create_subsystem("Web Application")

# List all subsystems
subsystems = api.list_subsystems()

漏洞存储

# Generic vulnerability storage
vuln_id = api.store_vulnerability(
    host_ip="192.168.1.100",
    vuln_type="sqli",
    severity="Critical",
    title="SQL Injection in Login",
    subsystem="Web Application",  # Optional
    description="Full description...",
    affected_component="/login",
    proof_of_concept="id=1' OR '1'='1",
    cvss_score=9.8,
    cwe_id="CWE-89"
)

# SQL Injection (convenience method)
vuln_id = api.store_sqli_vulnerability(
    host_ip="192.168.1.100",
    url="https://example.com/login?id=1",
    parameter="id",
    payload="1' OR '1'='1",
    db_type="MySQL",
    subsystem="Web Application",  # Optional
    **details
)

# XSS (convenience method)
vuln_id = api.store_xss_vulnerability(
    host_ip="192.168.1.100",
    url="https://example.com/search?q=test",
    xss_type="reflected",  # reflected/stored/dom
    payload="<script>alert(1)</script>",
    context="html_body",  # html_body/html_attribute/javascript/dom/url
    subsystem="Web Application",  # Optional
    **details
)

# LFI (convenience method)
vuln_id = api.store_lfi_vulnerability(
    host_ip="192.168.1.100",
    url="https://example.com/download?file=../../etc/passwd",
    payload="../../etc/passwd",
    file_read="root:x:0:0:root:/root:/bin/bash\n...",
    subsystem="Web Application",  # Optional
    **details
)

端口扫描存储

api.store_port_scan(
    host_ip="192.168.1.100",
    ports=[
        {
            "port": 80,
            "protocol": "tcp",
            "state": "open",
            "service": "http",
            "version": "Apache httpd 2.4.41",
            "product": "Apache"
        },
        {
            "port": 443,
            "protocol": "tcp",
            "state": "open",
            "service": "https"
        }
    ],
    scan_tool="nmap",
    subsystem="External Network"  # Optional
)

查询方法

# Get vulnerabilities with filters
vulns = api.get_vulnerabilities(
    subsystem="Web Application",  # Optional
    severity="Critical",          # Optional
    vuln_type="sqli",            # Optional
    host_ip="192.168.1.100"      # Optional
)
# Returns: List[Dict]

# Get host summary
summary = api.get_host_summary("192.168.1.100")
# Returns: Dict with open_ports, vulnerabilities, os_info, etc.

# Get statistics
stats = api.get_subsystem_statistics(subsystem="Web Application")
# Returns: Dict with total_vulnerabilities, severity_breakdown, etc.

ReportGenerator 类

gen = ReportGenerator(db_path="./data/results.db")

# Markdown report
markdown_path = gen.generate_markdown_report(
    output_path="report.md",      # Optional: auto-generates if None
    subsystem="Web Application"    # Optional: includes all if None
)

# JSON report
json_path = gen.generate_json_report(
    output_path="report.json",
    subsystem="Web Application"
)

# Executive summary only
summary = gen.generate_executive_summary(subsystem="Web Application")

# Risk score calculation
risk_info = gen.calculate_risk_score(vulnerabilities)
# Returns: {"score": 8.5, "level": "High"}

与现有技能集成

所有现有技能都提供可选的存储脚本。这些脚本：

1. 解析工具输出（nmap XML、sqlmap JSON 等）
2. 调用 StorageAPI 持久化发现结果
3. 支持 --subsystem 标志，用于可选分组

示例：端口扫描存储

# Flat hierarchy
nmap -sV -p- 192.168.1.0/24 -oX scan.xml
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
  --xml-file scan.xml

# With subsystem
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
  --xml-file scan.xml \
  --subsystem "External Network"

示例：SQLi 存储

sqlmap -u "https://example.com/login?id=1" --batch --answers=continuing
python .claude/skills/exploit-sqli/scripts/sqli_storage.py \
  --host-ip 192.168.1.100 \
  --url "https://example.com/login?id=1" \
  --parameter id \
  --subsystem "Web Application" \
  --severity Critical

使用场景

场景 1：多会话渗透测试

情况：你正在进行为期数天的渗透测试，需要跨会话保留状态。

# Day 1: Initial reconnaissance
nmap -sV -p- 192.168.1.0/24 -oX day1_scan.xml
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
  --xml-file day1_scan.xml \
  --subsystem "Customer A"

# Day 2: Web application testing
sqlmap -u "https://customer-a.com/login?id=1" --batch
python .claude/skills/exploit-sqli/scripts/sqli_storage.py \
  --host-ip 192.168.1.100 \
  --url "https://customer-a.com/login?id=1" \
  --parameter id \
  --subsystem "Customer A"

# Day 3: Generate report
python -c "
from .claude.skills.results-storage.scripts.report_generator import ReportGenerator
gen = ReportGenerator()
gen.generate_markdown_report('customer_a_report.md', 'Customer A')
"

场景 2：多子系统组织

情况：测试包含不同子系统（DMZ、内部网络、云环境）的大型网络。

# DMZ scanning
nmap -sV -p- 10.0.0.0/24 -oX dmz_scan.xml
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
  --xml-file dmz_scan.xml \
  --subsystem "DMZ"

# Internal network
nmap -sV -p- 192.168.1.0/24 -oX internal_scan.xml
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
  --xml-file internal_scan.xml \
  --subsystem "Internal"

# Cloud infrastructure
nmap -sV -p- 10.1.0.0/24 -oX cloud_scan.xml
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
  --xml-file cloud_scan.xml \
  --subsystem "Cloud"

# Generate subsystem-specific reports
python -c "
from .claude.skills.results-storage.scripts.report_generator import ReportGenerator
gen = ReportGenerator()
gen.generate_markdown_report('dmz_report.md', 'DMZ')
gen.generate_markdown_report('internal_report.md', 'Internal')
gen.generate_markdown_report('cloud_report.md', 'Cloud')
"

# Or generate comprehensive report
python -c "
gen = ReportGenerator()
gen.generate_markdown_report('full_report.md')
"

场景 3：漏洞查询

情况：你需要查找所有主机上的所有严重漏洞。

from .claude.skills.results-storage.scripts.storage_api import StorageAPI

api = StorageAPI()

critical_vulns = api.get_vulnerabilities(severity="Critical")

for vuln in critical_vulns:
    print(f"[{vuln['id']}] {vuln['title']}")
    print(f"  Host: {vuln['host_ip']}")
    print(f"  Type: {vuln['vulnerability_type']}")
    print(f"  CVSS: {vuln['cvss_score']}")
    print(f"  Discovered: {vuln['discovered_at']}")
    print()

场景 4：使用扁平层级

情况：无需复杂组织结构的简单测试。

# No subsystem specified - uses flat hierarchy
nmap -sV -p- 192.168.1.0/24 -oX scan.xml
python .claude/skills/recon-port-scan/scripts/port_scan_storage.py \
  --xml-file scan.xml

# Query flat hierarchy
python -c "
from .claude.skills.results-storage.scripts.storage_api import StorageAPI
api = StorageAPI()
api.store_xss_vulnerability(
    host_ip='192.168.1.100',
    url='https://example.com/search',
    xss_type='reflected',
    payload='<script>alert(1)</script>',
    # No subsystem = flat hierarchy
    severity='High',
    title='XSS in Search'
)
"

场景 5：基于主机的调查

情况：深入调查特定主机的发现结果。

from .claude.skills.results-storage.scripts.storage_api import StorageAPI

api = StorageAPI()

# Get comprehensive host summary
host_summary = api.get_host_summary("192.168.1.100")

print(f"IP: {host_summary['ip_address']}")
print(f"Hostname: {host_summary.get('hostname', 'Unknown')}")
print(f"OS: {host_summary.get('os_fingerprint', 'Unknown')}")
print(f"Open Ports: {len(host_summary['ports'])}")
print(f"Vulnerabilities: {len(host_summary['vulnerabilities'])}")

print("\n--- Vulnerabilities ---")
for vuln in host_summary['vulnerabilities']:
    print(f"[{vuln['severity']}] {vuln['title']}")

print("\n--- Open Ports ---")
for port in host_summary['ports']:
    print(f"Port {port['port']}/{port['protocol']}: {port.get('service', 'unknown')} ({port['state']})")

场景 6：自定义查询

情况：你需要查询特定漏洞模式。

from .claude.skills.results-storage.scripts.storage_api import StorageAPI

api = StorageAPI()

# All web vulnerabilities in a subsystem
web_vulns = api.get_vulnerabilities(
    subsystem="Web Application",
    vuln_type=["xss", "sqli", "lfi", "ssrf", "xxe"]
)

# High-severity SQLi across all subsystems
sqli_high = api.get_vulnerabilities(
    vuln_type="sqli",
    severity=["High", "Critical"]
)

# Vulnerabilities for a specific host
host_vulns = api.get_vulnerabilities(host_ip="192.168.1.100")

报告自定义

Markdown 报告章节

生成的报告包括：

1. 执行摘要 - 高层概述和风险评分
2. 方法论 - 测试方法和所用工具
3. 详细发现结果 - 按严重性分组的漏洞
4. 主机清单 - 所有已发现的主机
5. 建议 - 按优先级排列的修复步骤
6. 附录 - 命令、工具输出、合规性

JSON 报告架构

{
  "metadata": {
    "report_date": "2025-02-14",
    "test_period": {
      "start": "2025-02-10",
      "end": "2025-02-14"
    },
    "testers": ["pentester"]
  },
  "executive_summary": {
    "risk_score": 8.5,
    "total_vulnerabilities": 47,
    "severity_breakdown": {...}
  },
  "subsystems": [...],
  "hosts": [...],
  "vulnerabilities": [...],
  "recommendations": [...]
}

数据管理

数据库位置

./data/results.db

备份

# Simple backup
cp ./data/results.db ./data/results_backup_$(date +%Y%m%d).db

# Encrypted backup (recommended for production)
gpg --cipher-algo AES256 --compress-algo 1 --symmetric ./data/results.db

导出/导入

# SQLite to SQL
sqlite3 ./data/results.db .dump > results_backup.sql

# SQL to SQLite
sqlite3 ./data/results.db < results_backup.sql

重置数据库

# CAUTION: Deletes all data
rm ./data/results.db
# Database will be recreated on next use

性能注意事项

• 容量：已通过 10,000+ 个漏洞的测试
• 查询时间：筛选查询 < 1 秒
• 报告生成：包含 1,000+ 个漏洞的完整报告 < 10 秒
• 索引：针对常见查询模式自动创建

安全注意事项

数据保护

1. 数据库权限：Results.db 创建时的权限为 600（仅所有者可读写）
2. 敏感数据：数据库包含 PoC 代码——生产环境中请考虑加密
3. 审计跟踪：所有发现都包含时间戳和发现方法

最佳实践

• 定期备份：每次测试会话后进行备份
• 访问控制：确保文件系统权限受到严格限制
• 加密：将备份存储到共享位置前进行加密
• 保留期限：遵循数据保留政策——不再需要时删除数据

故障排除

数据库已锁定

# Check for processes using the database
lsof ./data/results.db

# Kill blocking processes if needed
kill -9 <PID>

导入错误

# Ensure Python path is correct
export PYTHONPATH="${PYTHONPATH}:$(pwd)"
python -c "from .claude.skills.results-storage.scripts.storage_api import StorageAPI"

报告生成错误

# Install Jinja2 if missing
pip install jinja2

# Verify database exists
ls -lh ./data/results.db

合规性

此存储和报告系统支持符合以下标准：

• OWASP Testing Guide v4.2
• PTES（Penetration Testing Execution Standard）
• OSSTMM（Open Source Security Testing Methodology）

所有时间戳均以 UTC 记录，以保持一致性。

相关技能

• recon-port-scan - 集成存储的端口扫描
• recon-subdomain - 集成存储的子域名枚举
• exploit-sqli - 集成存储的 SQL 注入测试
• exploit-xss - 集成存储的 XSS 测试
• exploit-lfi - 集成存储的 LFI 测试

高级用法

编程访问

import sqlite3

conn = sqlite3.connect('./data/results.db')
cursor = conn.cursor()

# Custom SQL queries
cursor.execute("""
    SELECT h.ip_address, COUNT(v.id) as vuln_count
    FROM hosts h
    LEFT JOIN vulnerabilities v ON h.id = v.host_id
    GROUP BY h.ip_address
    ORDER BY vuln_count DESC
""")

for row in cursor.fetchall():
    print(f"{row[0]}: {row[1]} vulnerabilities")

conn.close()

批量操作

from .claude.skills.results-storage.scripts.storage_api import StorageAPI

api = StorageAPI()

# Store multiple vulnerabilities
vulnerabilities = [
    {"host_ip": "192.168.1.100", "vuln_type": "xss", "severity": "High", ...},
    {"host_ip": "192.168.1.101", "vuln_type": "sqli", "severity": "Critical", ...},
]

for vuln_data in vulnerabilities:
    api.store_vulnerability(**vuln_data)

---

此技能为所有 pentest-skills 功能提供基础，支持持久化且有序的渗透测试数据管理。