n0mad1k
54 lines
2.6 KiB
Markdown
54 lines
2.6 KiB
Markdown
---
|
|
agent: env-validator
|
|
status: PARTIAL
|
|
timestamp: 2026-06-25T00:00:00Z
|
|
findings_count: 2
|
|
errors: []
|
|
---
|
|
|
|
# Env Validation — DevTrack #1259
|
|
|
|
## FAIL
|
|
- **okta-login.html.j2:102** — Real email address hardcoded in template: `Brian.Caldwell@Zimperium.com`
|
|
- Location: HTML form hidden input field (`fromURI` parameter)
|
|
- Risk: PII leak in template asset; exposed in version control
|
|
- Details: Value is HTML-encoded (`/`, `&`, `%40`, etc.) but fully readable when decoded
|
|
|
|
- **okta-login.html.j2:206** — Real Okta organization reference hardcoded: `zimperium.okta.com` + Okta app ID `exk1ufbfxuFLJp6y3697`
|
|
- Location: JavaScript variable `baseUrl` and `fromUri` in login page script
|
|
- Risk: Identifies real target organization; enables direct OSINT attack path
|
|
- Details: Okta app ID (`exk1ufbfxuFLJp6y3697`) is a unique identifier that can be used to enumerate target infrastructure
|
|
|
|
## WARN
|
|
None
|
|
|
|
## PASS
|
|
- **lander_gen.py** — Credentials passed via config dict, written to temp JSON files with mode 0o600, deleted after use. No filesystem persistence of secrets.
|
|
- **deploy_phishing.py** — SMTP password and other credentials collected via input prompts, stored in memory-only config dict, passed to Ansible via temporary JSON file (mode 0o600). No hardcoded secrets detected.
|
|
- **cloud-lander.html.j2, js-payload.js.j2** — Template variables only; no hardcoded secrets.
|
|
- **nginx-phishing-webserver.j2** — Nginx configuration template; no hardcoded credentials.
|
|
- **phishing-landing-page.j2** — Generic login template with Jinja2 placeholders; no hardcoded PII or secrets.
|
|
- **microsoft-login.html.j2** — Phishing template with placeholder values; no real credentials embedded.
|
|
- **Git history** — No evidence of secrets committed in recent git history (for these files).
|
|
|
|
## Remediation Required
|
|
|
|
### Critical
|
|
Replace okta-login.html.j2 with a **parameterized template**:
|
|
|
|
1. Remove hardcoded `Brian.Caldwell@Zimperium.com` and `zimperium.okta.com`
|
|
2. Replace with Jinja2 variables:
|
|
- `{{ target_email | default('') }}`
|
|
- `{{ okta_org_url | default('https://okta.example.com') }}`
|
|
- `{{ okta_app_id | default('') }}`
|
|
3. Populate these at deployment time via config dict, never in version control
|
|
4. Add a comment in the template: `<!-- Template variables: target_email, okta_org_url, okta_app_id -->`
|
|
|
|
### Process
|
|
Ensure all phishing templates follow the same pattern:
|
|
- **No real email addresses** in source
|
|
- **No real domain/org references** in source
|
|
- **All campaign-specific data injected at runtime** via Jinja2 context
|
|
- Credentials and PII sourced from config dict passed by `deploy_phishing.py`, never hardcoded
|
|
|