we45/threatplaybook

A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration

ThreatPlaybook

This is version 3 (beta)

What it was:

A (relatively) Unopinionated framework that faciliates Threat Modeling as Code married with Application Security Automation on a single Fabric

What it is now:

A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration

Documentation

• Quick Start
• Tutorial

Brought to you proudly by

threatplaybook's Issues

ERROR while setting setting up the client - pip install pyjq failed on windows host

Below is the stack trace on issuing docker-compose up command -

Creating threatplaybook_mongo_db_1 ... done
Creating threatplaybook_api_1 ... done
Creating threatplaybook_frontend_1 ... done
Creating threatplaybook_nginx_1 ... done
Attaching to threatplaybook_mongo_db_1, threatplaybook_api_1, threatplaybook_frontend_1, threatplaybook_nginx_1
frontend_1 | UPDATE AVAILABLE The latest version of serve is 11.3.0
frontend_1 | INFO: Accepting connections at http://localhost:8080
mongo_db_1 | 20:34:49.52
mongo_db_1 | 20:34:49.52 Welcome to the Bitnami mongodb container
mongo_db_1 | 20:34:49.53 Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-mongodb
mongo_db_1 | 20:34:49.53 Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-mongodb/issues
mongo_db_1 | 20:34:49.54 Send us your feedback at [email protected]
mongo_db_1 | 20:34:49.54
mongo_db_1 | 20:34:49.54 INFO ==> ** Starting MongoDB setup **
mongo_db_1 | 20:34:49.58 INFO ==> Validating settings in MONGODB_* env vars...
mongo_db_1 | 20:34:49.68 INFO ==> Initializing MongoDB...
mongo_db_1 | 20:34:49.69 INFO ==> No injected configuration files found. Creating default config files...
mongo_db_1 | 20:34:50.09 INFO ==> Enabling authentication...
mongo_db_1 | 20:34:50.10 INFO ==> Deploying MongoDB with persisted data...
mongo_db_1 | 20:34:50.11 INFO ==>
mongo_db_1 | 20:34:50.11 INFO ==> ########################################################################
mongo_db_1 | 20:34:50.11 INFO ==> Installation parameters for MongoDB:
mongo_db_1 | 20:34:50.11 INFO ==> Persisted data and properties have been restored.
mongo_db_1 | 20:34:50.11 INFO ==> Any input specified will not take effect.
mongo_db_1 | 20:34:50.11 INFO ==> (Passwords are not shown for security reasons)
mongo_db_1 | 20:34:50.11 INFO ==> ########################################################################
mongo_db_1 | 20:34:50.11 INFO ==>
mongo_db_1 | 20:34:50.12 INFO ==> Loading custom scripts...
mongo_db_1 | find: '/docker-entrypoint-initdb.d/': No such file or directory
mongo_db_1 |
mongo_db_1 | 20:34:50.13 INFO ==> ** MongoDB setup finished! **
mongo_db_1 | 20:34:50.15 INFO ==> ** Starting MongoDB **
mongo_db_1 | 2020-04-05T20:34:50.173+0000 I CONTROL [main] ***** SERVER RESTARTED *****
mongo_db_1 | 2020-04-05T20:34:50.175+0000 I CONTROL [main] Automatically disabling TLS 1.0, to force-enable TLS 1.0 specify --sslDisabledProtocols 'none'
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] MongoDB starting : pid=1 port=27017 dbpath=/bitnami/mongodb/data/db 64-bit host=3ae65973d6cf
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] db version v4.0.14
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] git version: 1622021384533dade8b3c89ed3ecd80e1142c132
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] OpenSSL version: OpenSSL 1.1.0l 10 Sep 2019
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] allocator: tcmalloc
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] modules: none
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] build environment:
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] distmod: debian92
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] distarch: x86_64
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] target_arch: x86_64
mongo_db_1 | 2020-04-05T20:34:50.179+0000 I CONTROL [initandlisten] options: { config: "/opt/bitnami/mongodb/conf/mongodb.conf", net: { bindIpAll: true, ipv6: false, port: 27017, unixDomainSocket: { enabled: true, pathPrefix: "/opt/bitnami/mongodb/tmp" } }, processManagement: { fork: false, pidFilePath: "/opt/bitnami/mongodb/tmp/mongodb.pid" }, security: { authorization: "enabled" }, setParameter: { enableLocalhostAuthBypass: "false" }, storage: { dbPath: "/bitnami/mongodb/data/db", directoryPerDB: false, journal: { enabled: true } }, systemLog: { destination: "file", logAppend: true, logRotate: "reopen", path: "/opt/bitnami/mongodb/logs/mongodb.log", quiet: false, verbosity: 0 } }
mongo_db_1 | 2020-04-05T20:34:50.186+0000 I STORAGE [initandlisten] wiredtiger_open config: create,cache_size=470M,cache_overflow=(file_max=0M),session_max=20000,eviction=(threads_min=4,threads_max=4),config_base=false,statistics=(fast),log=(enabled=true,archive=true,path=journal,compressor=snappy),file_manager=(close_idle_time=100000),statistics_log=(wait=0),verbose=(recovery_progress),
mongo_db_1 | 2020-04-05T20:34:50.743+0000 E STORAGE [initandlisten] WiredTiger error (17) [1586118890:743268][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: File exists Raw: [1586118890:743268][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: File exists
mongo_db_1 | 2020-04-05T20:34:50.749+0000 I STORAGE [initandlisten] WiredTiger message unexpected file WiredTiger.wt found, renamed to WiredTiger.wt.3
mongo_db_1 | 2020-04-05T20:34:50.755+0000 E STORAGE [initandlisten] WiredTiger error (1) [1586118890:755251][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: Operation not permitted Raw: [1586118890:755251][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: Operation not permitted
mongo_db_1 | 2020-04-05T20:34:50.780+0000 E STORAGE [initandlisten] WiredTiger error (17) [1586118890:780456][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: File exists Raw: [1586118890:780456][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: File exists
mongo_db_1 | 2020-04-05T20:34:50.796+0000 I STORAGE [initandlisten] WiredTiger message unexpected file WiredTiger.wt found, renamed to WiredTiger.wt.4
mongo_db_1 | 2020-04-05T20:34:50.807+0000 E STORAGE [initandlisten] WiredTiger error (1) [1586118890:806999][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: Operation not permitted Raw: [1586118890:806999][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: Operation not permitted
mongo_db_1 | 2020-04-05T20:34:50.833+0000 E STORAGE [initandlisten] WiredTiger error (17) [1586118890:833557][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: File exists Raw: [1586118890:833557][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: File exists
mongo_db_1 | 2020-04-05T20:34:50.843+0000 I STORAGE [initandlisten] WiredTiger message unexpected file WiredTiger.wt found, renamed to WiredTiger.wt.5
mongo_db_1 | 2020-04-05T20:34:50.849+0000 E STORAGE [initandlisten] WiredTiger error (1) [1586118890:849607][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: Operation not permitted Raw: [1586118890:849607][1:0x7fe826cc2080], connection: __posix_open_file, 672: /bitnami/mongodb/data/db/WiredTiger.wt: handle-open: open: Operation not permitted
mongo_db_1 | 2020-04-05T20:34:50.852+0000 W STORAGE [initandlisten] Failed to start up WiredTiger under any compatibility version.
mongo_db_1 | 2020-04-05T20:34:50.852+0000 F STORAGE [initandlisten] Reason: 1: Operation not permitted
mongo_db_1 | 2020-04-05T20:34:50.852+0000 F - [initandlisten] Fatal Assertion 28595 at src/mongo/db/storage/wiredtiger/wiredtiger_kv_engine.cpp 707
mongo_db_1 | 2020-04-05T20:34:50.852+0000 F - [initandlisten]
mongo_db_1 |
mongo_db_1 | ***aborting after fassert() failure
mongo_db_1 |
mongo_db_1 |
threatplaybook_mongo_db_1 exited with code 14

Unable to change the default password for admin : playbook client returns error

Hi @abhaybhargav
I am able to setup the server side components. While I try to setup the playbook client.
I am able to do the first step i.e Playbook configure
But in the second step i.e changing the default password, I am failed to get through it. I am getting some JSONDecodeError. Not sure what's wrong here..
I have attached the error I am getting.
I have also updated the JWT value in the compose file by the latest value.

Thanks in advance.

Write v3 Docs in Markdown and push to Gitbook/X

Simplify UI with better visuals

JWT Token for Server - Add Claims

• Add exp claim to JWT and add that to the cred file as well
• Ensure that you check against the exp in cred before you allow the user to use the cli again

location of requirements.txt in example-rundown could be explained more

In https://we45.gitbook.io/threatplaybook/example-rundown where it says to:

Install the Dependencies for the example with pip install -r requirements.txt

It's not quite clear to me where that file comes from and what is in it.

If you don't mind explaining a little more about that file, it would be helpful.

Make decision between Flask and Responder for REST API

Flask Benefits:

• Mature Framework
• Can be deployed to SLS
• Benefit over Responder:
• Less verbose in terms of code
• More support for JSON OOB

Responder Benefits:

• ASGI, seems to be more self-contained than Flask, which requires an additional server
• Built in GraphQL Support
• Python async (not sure if Flask supports as well)

ModuleNotFoundError: No module named 'six'

Observation:
It has been observed that after bringing up the ThreatPlaybook server, and installing the threatplaybook-client (using pip install), trying to run the playbook CLI binary, results in the following error.

Traceback (most recent call last):
  File "/<ThreatPlaybook_InstallPath>/vEnv_ThreatPlaybook/bin/playbook", line 5, in <module>
    from playbook import main
  File "/<ThreatPlaybook_InstallPath>/vEnv_ThreatPlaybook/lib/python3.7/site-packages/playbook/__init__.py", line 31, in <module>
    from . import utils
  File "/<ThreatPlaybook_InstallPath>/vEnv_ThreatPlaybook/lib/python3.7/site-packages/playbook/utils.py", line 1, in <module>
    import pyjq
  File "/<ThreatPlaybook_InstallPath>/vEnv_ThreatPlaybook/lib/python3.7/site-packages/pyjq.py", line 4, in <module>
    from six.moves import urllib
ModuleNotFoundError: No module named 'six'

Workaround:
Doing a pip install six, fixed the issue.

Write dockerfile for API

Dockerfile and Compose for API with

• Nginx with frontend (static)
• API
• Mongo

Playbook UI showing XSS testcase in SQL reference.

Hi @abhaybhargav. I have completed the setup as per the process and working with default configurations. But somehow, Playbook UI showing XSS related issues in the story of SQL injection. It seems like all the threat scenarios defined under one abuse case referring to the test case of the last defined Threat scenario. Feature file has "reference: {name: sql_injection, severity: 3}" but UI showing test case for XSS which is the last reference in the feature file for threat scenario. Screenshots attached.

ERROR: An error occurred while resolving field Query.projects

I started the service using, "docker-compose up". Everything seems to download and install and the login page is presented. After logging in, the browser is redirected to, "http://127.0.0.1/home", which is blank.

The logs contain the following errors. Is this an environmental issue or an issue with the latest release?

api_1 | ERROR: An error occurred while resolving field Query.projects
api_1 | Traceback (most recent call last):
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1 | return executor.execute(resolve_fn, source, info, **args)
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1 | return fn(*args, **kwargs)
api_1 | File "/threatplaybook/gql.py", line 817, in resolve_projects
api_1 | raise Exception("Unauthorized to perform action")
api_1 | Exception: Unauthorized to perform action
api_1 | ERROR: Traceback (most recent call last):
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1 | return executor.execute(resolve_fn, source, info, **args)
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1 | return fn(*args, **kwargs)
api_1 | File "/threatplaybook/gql.py", line 817, in resolve_projects
api_1 | raise Exception("Unauthorized to perform action")
api_1 | graphql.error.located_error.GraphQLLocatedError: Unauthorized to perform action
api_1 |
api_1 | ERROR: An error occurred while resolving field Query.userStories
api_1 | Traceback (most recent call last):
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1 | return executor.execute(resolve_fn, source, info, **args)
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1 | return fn(*args, **kwargs)
api_1 | File "/threatplaybook/gql.py", line 823, in resolve_user_stories
api_1 | raise Exception("Unauthorized to perform action")
api_1 | Exception: Unauthorized to perform action
api_1 | ERROR: Traceback (most recent call last):
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1 | return executor.execute(resolve_fn, source, info, **args)
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1 | return fn(*args, **kwargs)
api_1 | File "/threatplaybook/gql.py", line 823, in resolve_user_stories
api_1 | raise Exception("Unauthorized to perform action")
api_1 | graphql.error.located_error.GraphQLLocatedError: Unauthorized to perform action
api_1 |
api_1 | ERROR: An error occurred while resolving field Query.scenarios
api_1 | Traceback (most recent call last):
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1 | return executor.execute(resolve_fn, source, info, **args)
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1 | return fn(*args, **kwargs)
api_1 | File "/threatplaybook/gql.py", line 829, in resolve_scenarios
api_1 | raise Exception("Unauthorized to perform action")
api_1 | Exception: Unauthorized to perform action
api_1 | ERROR: Traceback (most recent call last):
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1 | return executor.execute(resolve_fn, source, info, **args)
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1 | return fn(*args, **kwargs)
api_1 | File "/threatplaybook/gql.py", line 829, in resolve_scenarios
api_1 | raise Exception("Unauthorized to perform action")
api_1 | graphql.error.located_error.GraphQLLocatedError: Unauthorized to perform action
api_1 |
api_1 | ERROR: An error occurred while resolving field Query.scans
api_1 | Traceback (most recent call last):
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1 | return executor.execute(resolve_fn, source, info, **args)
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1 | return fn(*args, **kwargs)
api_1 | File "/threatplaybook/gql.py", line 811, in resolve_scans
api_1 | raise Exception("Unauthorized to perform action")
api_1 | Exception: Unauthorized to perform action
api_1 | ERROR: Traceback (most recent call last):
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1 | return executor.execute(resolve_fn, source, info, **args)
api_1 | File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1 | return fn(*args, **kwargs)
api_1 | File "/threatplaybook/gql.py", line 811, in resolve_scans
api_1 | raise Exception("Unauthorized to perform action")
api_1 | graphql.error.located_error.GraphQLLocatedError: Unauthorized to perform action

ThreatPlaybook docker graphQL Error

I am using docker setup.

I have tried to login using following credentials :

username : "[email protected]"
password : "pl@yb00k1234"

It logs in but shows a blank page. On console api throws graphql error.

Error message -->

api_1       | Traceback (most recent call last):
api_1       |   File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1       |     return executor.execute(resolve_fn, source, info, **args)
api_1       |   File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1       |     return fn(*args, **kwargs)
api_1       |   File "/threatplaybook/gql.py", line 684, in resolve_projects
api_1       |     raise Exception("Unauthorized to perform action")
api_1       | Exception: Unauthorized to perform action
api_1       | ERROR: Traceback (most recent call last):
api_1       |   File "/usr/local/lib/python3.6/site-packages/graphql/execution/executor.py", line 447, in resolve_or_error
api_1       |     return executor.execute(resolve_fn, source, info, **args)
api_1       |   File "/usr/local/lib/python3.6/site-packages/graphql/execution/executors/sync.py", line 16, in execute
api_1       |     return fn(*args, **kwargs)
api_1       |   File "/threatplaybook/gql.py", line 684, in resolve_projects
api_1       |     raise Exception("Unauthorized to perform action")
api_1       | graphql.error.located_error.GraphQLLocatedError: Unauthorized to perform action

Deploy to docker once Rel is done. This specifically is for the API, as there's no real value of the Automation lib being in Docker

wfuzz output is not writing to file until robot finishes test

FSADeprecationWarning: SQLALCHEMY_TRACK_MODIFICATIONS adds significant overhead

After loading the Docker abhaybhargav/vul_flask image and attempting to run it, a message about adding significant overhead is given as shown below.
It seemed to sit there for a while, so I used ctl-c to exit.
I am using Ubuntu 18.04

docker run abhaybhargav/vul_flask
/usr/local/lib/python2.7/site-packages/flask_sqlalchemy/init.py:839: FSADeprecationWarning: SQLALCHEMY_TRACK_MODIFICATIONS adds significant overhead and will be disabled by default in the future. Set it to True or False to suppress this warning.
'SQLALCHEMY_TRACK_MODIFICATIONS adds significant overhead and '
^CTraceback (most recent call last):
File "app.py", line 340, in
IOLoop.instance().start()
File "/usr/local/lib/python2.7/site-packages/tornado/ioloop.py", line 863, in start
event_pairs = self._impl.poll(poll_timeout)
KeyboardInterrupt

ThreatPlaybook Client installation failed on Mac - "Running setup.py install for pyjq ... error"

Hi,
I am facing issues while installing ThreatPlaybook Client on Mac machine Darwin-MacBook-Pro.local 19.4.0 Darwin Kernel Version 19.4.0 with Python 2.7.18 and pip 19.2.3
I have followed below steps

1. Install Python 2.7
2. Run pip install ThreatPlaybook-Client OR sudo -H pip install ThreatPlaybook-Client

setup failed on "pyjq" installation

ERROR: Command errored out with exit status 1: /Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python -u -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/private/var/folders/5t/s_ltq5zs3s91srr2fkng2hzw0000gn/T/pip-install-0a7qlN/pyjq/setup.py'"'"'; file='"'"'/private/var/folders/5t/s_ltq5zs3s91srr2fkng2hzw0000gn/T/pip-install-0a7qlN/pyjq/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(file);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, file, '"'"'exec'"'"'))' install --record /private/var/folders/5t/s_ltq5zs3s91srr2fkng2hzw0000gn/T/pip-record-er5FZl/install-record.txt --single-version-externally-managed --compile Check the logs for full command output.

Please let me know if I have missed anything. I appreciate your help in resolving the issue.
Thanks so much!
ThreatPlaybook_Error_Mac.TXT

Remove DREAD and simplify threat scenarios frame

playbook change-password throws 403

I have used docker-setup to load the stack.

My docker-compose file -->

version: '3'
services:
  nginx:
    image: we45/threatplaybook-nginx:latest
    ports:
      - "80:80"
    depends_on:
      - api
      - frontend
    links:
      - api
      - frontend
  mongo_db:
    image: bitnami/mongodb:latest
    user: root
    environment:
      - MONGODB_USERNAME=threatplaybook
      - MONGODB_PASSWORD=password123
      - MONGODB_DATABASE=threat_playbook
    expose:
      - "27017"
    ports:
      - "27017:27017"
    volumes:
      - ./threatplaybook_db:/bitnami
  api:
    image: we45/threatplaybook-api:latest
    expose:
      - "5042"
    ports:
      - "5042:5042"
    environment:
      - MONGO_HOST=mongo_db
      - MONGO_USER=threatplaybook
      - MONGO_PASS=password123
      - MONGO_PORT=27017
      - MONGO_DB=threat_playbook
      - [email protected]
      - SUPERUSER_PASS=supersecret
      - JWT_PASS=VGCxqDnhsN6vNQVqmXtrNVVe1AS36ZMQKTq6lYpj0ygHiuWunMOkFi2j17cHSbG-WId9x_yJpeSqy0TTFjs06Q
      - WAIT_HOSTS=mongo_db:27017
    links:
      - mongo_db
    depends_on:
      - mongo_db
    command: sh -c "./wait-for mongo_db:27017 -- /usr/local/bin/python3.6 /threatplaybook/app.py"
  frontend:
    image: we45/threatplaybook-frontend:4.1
    expose:
      - "8080"
    ports:
      - "8080:8080"
    environment:
      - API_URL=http://api:5042
    links:
      - api
    depends_on:
      - api

After executing 'playbook change-password' api throws error

error message -->

api_1       | INFO: ('192.168.224.1', 49940) - "POST /change-password HTTP/1.1" 403

playbook init <project_name> does not create boilerplate directories (entities, results, security_tests)

Hi @abhaybhargav
The python client (playbook) doesn't create the boilerplate directories when I run below command.

playbook init new_project
It only creates cases folder.
Below is the screen shot for the same.

Please suggest. Do I have to install robot python packages..

Thanks.

Multiple CLI bugs

• set session is not working
• get vulnerabilities in multiple formats

Explore md2py for Markdown parser

metadata page checksum error on repo.db

Under Ubuntu 18.04, after installing mongodb, Pyton 2.7, the Robot Framework, nodejs, Mermaid CLI, setting up a virtualenv for the Python install, running "source venv/bin/activate", and successfully running "pip install ThreatPlaybook", attempting to run:

threat-playbook TestProject1

gives:

BDB0210 /home/raya/ThreatPlaybook/venv/local/lib/python2.7/site-packages/threat_playbook/repo.db: metadata page checksum error
Traceback (most recent call last):
File "/home/raya/ThreatPlaybook/venv/bin/threat-playbook", line 7, in
from threat_playbook import main
File "/home/raya/ThreatPlaybook/venv/local/lib/python2.7/site-packages/threat_playbook/init.py", line 39, in
rdb = shelve.open(os.path.join(module_path, "repo"))
File "/usr/lib/python2.7/shelve.py", line 243, in open
return DbfilenameShelf(filename, flag, protocol, writeback)
File "/usr/lib/python2.7/shelve.py", line 227, in init
Shelf.init(self, anydbm.open(filename, flag), protocol, writeback)
File "/usr/lib/python2.7/anydbm.py", line 85, in open
return mod.open(file, flag, mode)
File "/usr/lib/python2.7/dbhash.py", line 18, in open
return bsddb.hashopen(file, flag, mode)
File "/usr/lib/python2.7/bsddb/init.py", line 364, in hashopen
d.open(file, db.DB_HASH, flags, mode)
bsddb.db.DBError: (21, 'Is a directory')

type threat-playbook
threat-playbook is hashed (/home/raya/ThreatPlaybook/venv/bin/threat-playbook)

Any suggestions on what the problem might be?

Push Robot and CLI to pypi

• Create setup.py for both libs
• robot in pypi should just be called ThreatPlaybook
• cli should be called Threatplaybook-Controller

Change the value of VUE_APP_API_URL in docker-compose file

Please change it to "VUE_APP_API_URL=http://localhost:5042"

Replace pyjq as it doesnt work with Windows OS for Playbook Client

UI Activities

Things to do:

• Wordwrap for diagram elements
• Better diagram orientation if possible