Output Structure

Introduction

AVAIN and its modules create many output files that can be very detailed and helpful. Therefore, knowing how the output files are structured can be useful.

General Structure

AVAIN puts its output into a directory that generally looks like the following:

avain_output-20180905_005831
├── modules
│   ├── cve_correlation
│   │   ├── cve_summary.json
│   │   ├── found_cves.json
│   │   └── result.json
│   ├── login_bruteforce
│   │   ├── hydra_ssh
│   │   └── hydra_telnet
│   ├── web
│   │   ├── crawler
│   │   ├── cms_scanner
│   │   ├── gobuster
│   │   └── sqlmap
│   ├── login_bruteforce
│   ├── nmap
│   └── smb
├── user_results
├── scan_result_aggregation
├── vuln_score_aggregation
├── webserver_map_aggregation
├── avain.log
└── network_vulnerability_ratings.json

AVAIN's log file avain.log and the final results containing the vulnerability rating(s), network_vulnerability_ratings.json, are on the first directory level. The remaining files are put into a modules subdirectory, a user_results subdirectory and several result aggregation subdirectories, one for every type of shared result. AVAIN's goal is to keep all useful (intermediate) results. For example all of the found CVEs are stored within the cve_correlation module's subdirectory. Similarly, every other module has its own subdirectory for its results. The hierarchy of the modules subdirectory is the same as the one that contains the source code. The result files that each module outputs are described on the separate Module Overview wiki page. Note that the -o flag can be specified to customly set the name of AVAIN's output directory. An example result is available here.

Extended Structure

If the user specifies more than one network to assess and appends the -sN flag), the networks are assessed independently and the results are put into different subdirectories. This could look like the following:

avain_output-20180905_011115/
├── avain.log
├── net_dir_map.json
├── network_1
│   ├── ...
│   └── modules
├── network_2
│   ├── ...
│   └── modules
└── network_vulnerability_ratings.json

Here, the different networks are listed as network_1 and network_2. This is because directories on Unix have naming restrictions that e.g. prevent the creation of a single directory called 192.168.0.0/24. The directories are numberered according to the order of their network expressions in the AVAIN call. Also, a translation between the output directories and given network expressions is available in the file net_dir_map.json.