varchashva/letsmapyournetwork

Lets Map Your Network enables you to visualise your physical network in form of graph with zero manual error

Omniscient - Let’s Map [Your] Network (v2.0)

Table of Contents

1. WHAT IT IS
2. WHY IT IS
3. WHERE TO USE IT
4. Presentations
5. Key Features
6. Installation Guidelines
7. HOW TO USE IT
8. Understand Node
9. Contributer
10. LMYN In Action
11. Roadmap
12. Contact Information

WHAT IT IS

It is utmost important for any security engineer to understand their network first before securing it and it becomes a daunting task to have a ‘true’ understanding of a widespread network. In a mid to large level organisation’s network having a network architecture diagram doesn’t provide the complete understanding and manual verification is a nightmare. Hence in order to secure entire network it is important to have a complete picture of all the systems which are connected to your network, irrespective of their type, function, techology etc.

BOTTOM LINE - YOU CAN'T SECURE WHAT YOU ARE NOT AWARE OF.

Let’s Map Your Network (LMYN) aims to provide an easy to use interface to security engineer and network administrator to have their network in graphical form with zero manual error, where a node represents a system and relationship between nodes represent the connection.

LMYN does it in two phases:

1. Learning: In this phase LMYN 'learns' the network by performing the network commands and quering the APIs and then builds graph database leveraging the responses. User can perform any of the learning activities at any point of time and LMYN will incorporate the results in existing database.
2. Monitoring: This is a continuos process, where LMYN monitors the 'in-scope' network for any changes, compare it with existing information and update the graph database accordingly.

Below technologies have been used in the tool:

1. Django Python
2. Neo4j DB
3. Sigma JS
4. Celery and RabbitMQ

WHY IT IS

• Visualizing infrastructure network in form of graph makes it more ‘visible’ and it becomes significantly easy to perform the analysis and identify the key areas of concern for a security engineer and network administrator
• Also, Let’s Map Your Network formulates the graph entirely based-on either network actions performed from ‘seed’ system which will be part of the actual network or quering the APIs. Hence there is no chance of manual-error in the mapping of network

WHERE TO USE IT

1. Network Architecture 'Validation'
2. Troubleshooting for network administrator
3. Internal Network vulnerability assessment and penetration testing

Presentations

• BlackHatEurope2018 presentation slide
• Demo Videos

Contributer

Jyoti Raval: (Brutal!) QA

LMYN In Action

Local subnet network

Network with traceroute to mulitple destinations

CMDB Upload

Cloud network

Contact Information

• Email: varchashva [at] gmail [dot] com
• LinkedIn: https://www.linkedin.com/in/pramod-rana-696ba062
• Twitter: https://twitter.com/IAmVarchashva

letsmapyournetwork's Issues

Docker compose images do not work.

Seems to be a configuration isssue. For one thing going to the default port host:9999 brings you to the default Django landing page.

When navigating to core default statisics page shows ok.:

But trying to create a project fails.

Even replacing //action with /action fails to find files.

This was creating the containers from the docker-compose.yml file.

For reference docker engine version is 18.09.6 and docker-compose version is 1.24.0-rc3, build 42894249 both on Debian Stretch.

Support for VLAN mapping

Hello,
This tool looks amazing, Does it support VLAN mapping? In a multi-tenant environment can I map out a VLAN and see the end devices, which switches this VLAN passes and the connections between each switches for that particular network?

corrections on my previous statement

Hello Guys, I realized that I downloaded the old LetsMapYournetwork file from the start so i managed to download the bug fixed one having the manage.py class..Thanks for the great job you do for the online community, It benefits people like me..All the best to the Creator of this Network Web system..

New idea

From a pent tester perspective, I think it would be great to add option to remotely manage devices from the map.

Ex. Click on image and it allows you to save command you use to exploit said device. Or remotely manage, whichever floats your boat. So click on device and it opens a pop up window where I can paste text such as running a exploit or entering my remote ssh command.

Using Docker Compose not working

I am using Docker compose to test it out, but i cant get it to work

Seems like "Neo4j is up" according to the output but curl -v http://localhost:7474/ gives connection refused.

sudo docker-compose up
Password:
Starting letsmapyournetwork_neo4j_1 ... done
Starting letsmapyournetwork_lmyn_1 ... done
Attaching to letsmapyournetwork_neo4j_1, letsmapyournetwork_lmyn_1
lmyn_1 | Neo4j isn't available. Let's wait for sometime
lmyn_1 | python manage.py runserver 0.0.0.0:9999
neo4j_1 | Active database: graph.db
neo4j_1 | Directories in use:
neo4j_1 | home: /var/lib/neo4j
neo4j_1 | config: /var/lib/neo4j/conf
neo4j_1 | logs: /var/lib/neo4j/logs
neo4j_1 | plugins: /var/lib/neo4j/plugins
neo4j_1 | import: /var/lib/neo4j/import
neo4j_1 | data: /var/lib/neo4j/data
neo4j_1 | certificates: /var/lib/neo4j/certificates
neo4j_1 | run: /var/lib/neo4j/run
neo4j_1 | Starting Neo4j.
neo4j_1 | 2018-12-19 22:30:49.570+0000 WARN Unknown config option: causal_clustering.discovery_listen_address
neo4j_1 | 2018-12-19 22:30:49.578+0000 WARN Unknown config option: causal_clustering.raft_advertised_address
neo4j_1 | 2018-12-19 22:30:49.578+0000 WARN Unknown config option: causal_clustering.raft_listen_address
neo4j_1 | 2018-12-19 22:30:49.578+0000 WARN Unknown config option: ha.host.coordination
neo4j_1 | 2018-12-19 22:30:49.579+0000 WARN Unknown config option: causal_clustering.transaction_advertised_address
neo4j_1 | 2018-12-19 22:30:49.579+0000 WARN Unknown config option: causal_clustering.discovery_advertised_address
neo4j_1 | 2018-12-19 22:30:49.579+0000 WARN Unknown config option: ha.host.data
neo4j_1 | 2018-12-19 22:30:49.579+0000 WARN Unknown config option: causal_clustering.transaction_listen_address
lmyn_1 | Neo4j isn't available. Let's wait for sometime
lmyn_1 | python manage.py runserver 0.0.0.0:9999
neo4j_1 | 2018-12-19 22:30:49.619+0000 INFO ======== Neo4j 3.3.0 ========
neo4j_1 | 2018-12-19 22:30:49.685+0000 INFO Starting...
lmyn_1 | python manage.py runserver 0.0.0.0:9999
lmyn_1 | Neo4j isn't available. Let's wait for sometime
neo4j_1 | 2018-12-19 22:30:51.135+0000 INFO Bolt enabled on 0.0.0.0:7687.
lmyn_1 | Neo4j isn't available. Let's wait for sometime
lmyn_1 | python manage.py runserver 0.0.0.0:9999
lmyn_1 | python manage.py runserver 0.0.0.0:9999
lmyn_1 | Neo4j isn't available. Let's wait for sometime
lmyn_1 | python manage.py runserver 0.0.0.0:9999
lmyn_1 | Neo4j isn't available. Let's wait for sometime
lmyn_1 | python manage.py runserver 0.0.0.0:9999
lmyn_1 | Neo4j isn't available. Let's wait for sometime
lmyn_1 | python manage.py runserver 0.0.0.0:9999
lmyn_1 | Neo4j isn't available. Let's wait for sometime
neo4j_1 | 2018-12-19 22:30:55.935+0000 INFO Started.
lmyn_1 | python manage.py runserver 0.0.0.0:9999
lmyn_1 | Neo4j isn't available. Let's wait for sometime
neo4j_1 | 2018-12-19 22:30:57.316+0000 INFO Remote interface available at http://localhost:7474/
lmyn_1 | HTTP/1.1 200 OK
lmyn_1 | Neo4j is up now. Let's go...

Create project -> 404, cloud-activites->404, find-me-> 404,

Hi - saw you at BH this year, looks like a great tool but seeing a bunch of bugs & I don't know how the logic/code base is yet. I'm trying to include LMYN on the Kali server of the Cyber Range project.

Tried creating a new project & I'm hitting a page not found error.

I found the default install doesn't have the default project selected, once I select it, I can add a new project. I also found a bunch of other 404 errors in the cloud activities, find me, and the host counts were increasing yet this was the only asset up in that cloud subnet at that time.

I tried getting this loaded on my macbook but there is a docker-compose limitation. Might be good to update the docker-compose instructions indicating this project requires a docker feature which does not work on osx yet: docker/compose#4799 (comment)

I have a 2min screencast if you want me to share it.

neo4j error when docker-compose up

Hi !
uname -a :
Linux x-modified-x 5.16.0-kali3-amd64 #1 SMP PREEMPT Debian 5.16.11-1kali1 (2022-03-03) x86_64 GNU/Linux

docker-compose version:
docker-compose version 1.29.2, build unknown
docker-py version: 5.0.3
CPython version: 3.9.10
OpenSSL version: OpenSSL 1.1.1m 14 Dec 2021

I have issue when i try to deploy the project with sudo docker-compose up.

i got this error :

ERROR: for lmyn_neo4j_1 "host" network_mode is incompatible with port_bindings
ERROR: for neo4j "host" network_mode is incompatible with port_bindings
[...]
File "/usr/lib/python3/dist-packages/docker/types/containers.py", line 336, in init
raise host_config_incompatible_error(
docker.errors.InvalidArgument: "host" network_mode is incompatible with port_bindings

and nothing more... I am new with docker so i can't debug the issue ...

could you help ? :)

Map usage

Hello,
I could install and run from the docker images. I am able to get ~187 hosts. Once I select the project it goes constanly between "In progress" and "all completed", updating the browser page, and retreiving task_state view, the graph is updating all the time so unusable ! I dont have CMDB file, I am just trying to get the topology blindly. How can I start visualizing the topology of those 187 hosts without having constant refreshs or updates on Takstrings ?
Thank you a lot !

cannot find manage.py class in the home folder but the class is called in "sudo python $LMYN_HOME/LetsMapYourNetwork/manage.py runserver 0.0.0.0:9999 --insecure

help me with the configuration of starting there bcauz i have installed all the required dependencies and packages including neo4j server and rabit, they both are running..

Default credentials

There is no information about the login credentials, or al least I didn't find them anywhere.
I'm LMYN via Docker compose.

some error

I run it in my server use docker-compose ,and visit it by chrome form my pc ,when the page notice some error

Failed to load resource: net::ERR_CONNECTION_REFUSED http://localhost:7474/db/data/transaction/commit
maybe it's something error

Neo4j in Docker needs to be secured

This line

LetsMapYourNetwork/docker-compose.yml

Line 9 in 816308d

- NEO4J_AUTH=none # Neo4j authentication is disabled for Docker installation

makes Neo4j open for anyone in the world (if you are not behind firewall/NAT). It should either not use 'host' network, listen 127.0.0.1 or should be secured with password/firewall but current setup is insecure.

Directions need update

1- Install on Windows fails - (Also missing step) install programming language

• Get error at the end of this step ( ◦Run command python -m pip install --trusted-host pypi.python.org -r $LMYN/LetsMapYourNetwork/requirements.txt)

• This command doesn't work ( 10.Run Celery as below from $LMYN_HOME directory ◦celery -A LetsMapYourNetwork -l warning)

• same for step 11
  and 12 never worked even though service was running -

2- Installing Java 8 fails on linux ( no longer supported ) installing new versions of java don't work with neo4j

** Would recommend building a Linux VM template for people to deploy ( Already installed and tested) - Easier to deploy the more people will use it -