Overview: The flask application will accept a hostname from a user on the web-interface and then the hostname will be scanned using the testssl.sh script and for this I have tried to use the subprocess module to execute a sequence of commands by accessing the powershell using the subprocess module. When I am running the application on the development server, it is working as expected, but after deploying it on Microsoft IIS the following happens:
If deployed using HttpPlatformHandler, the application does not work as expected and in the log file it gets logged that The system cannot find the path specified (whereas nothing as such is depicted when using development server i.e. localhost:5000) Image of Log file when deployed using HttpPlatformHandler
If deployed using FastCGIHandler, then it throws the error like this (as shown in this post: https://stackoverflow.com/a/74404235/21615762). Even if I do make the changes as mentioned in the only answer given in this post, the application does not work as expected and in the log file only the following texts are logged and nothing else:
2023-05-25 07:46:27.325112: wfastcgi.py will restart when files in C:\inetpub\wwwroot\scanFCGI\ are changed: .((.py)|(.config))$ 2023-05-25 07:46:27.330072: wfastcgi.py 3.0.0 initialized 2023-05-25 07:46:27.760587: wfastcgi.py will restart when files in C:\inetpub\wwwroot\scanFCGI\ are changed: .((.py)|(.config))$ 2023-05-25 07:46:27.763589: wfastcgi.py 3.0.0 initialized 2023-05-25 07:51:40.936882: Running on_exit tasks 2023-05-25 07:51:40.952487: wfastcgi.py 3.0.0 closed 2023-05-25 07:51:42.405906: Running on_exit tasks 2023-05-25 07:51:42.405906: wfastcgi.py 3.0.0 closed
FLASK APPLICATION
from flask import Flask, render_template, request, jsonify, url_for, send_file
import subprocess
import os
import datetime
onlytime = datetime.datetime.now().strftime("%H%M")
app = Flask(__name__) # Name of the flask application
@app.route("/") # Default Route
def index():
return render_template("Internal_Scanner.html")
@app.route(
"/scan", methods=["POST"]
) # Route to be taken when the Begin Scan button is clicked on the webpage
def scan():
# Get the hostname from the form data
hostname = request.form.get("hostname")
if len(hostname) > 50:
return jsonify({"return_output": "The hostname is too long."})
elif hostname.find(" ") != -1:
return jsonify(
{
"return_output": "The entered hostname is not valid as it has a whitespace."
}
)
else:
if hostname.find(":") == -1:
htmlfilename = "{}_{}.html".format(hostname, onlytime)
else:
htmlfilename = "{}_{}.html".format((hostname.split(":"))[0], onlytime)
# form the command sequence to be executed in powershell
comm = "cd ..; cd .\\Ubuntu\\Ubuntu_2004.2021.825.0_x64\\; .\\ubuntu.exe run 'cd ..; cd ..; cd testssl.sh-3.1dev/; ./testssl.sh --htmlfile ../scanner/reports/scans/{} {}'".format(htmlfilename, hostname)
subprocess.run(['powershell.exe','-Command',comm], shell=True)
return_output = f"Scan completed for hostname: {hostname}."
download_link = f"/api/download/{htmlfilename}"
return jsonify(return_output=return_output, download_link=download_link)
@app.route(
"/api/download/<string:filename>", methods=["GET"]
) # Route to serve the generated report as a URL
def download_report(filename):
# Serve the file from the reports directory
# r"C:\WSL\reports\scans"
file_path = os.path.join(r"C:\inetpub\wwwroot\scanner\reports\scans", filename)
if os.path.isfile(file_path):
return send_file(file_path, as_attachment=True)
else:
return jsonify({"error": "File not found"})
if __name__ == "__main__":
app.run()`
HttpPlatformHandler web.config
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<httpPlatform processPath="C:\Users\PRATEEK\AppData\Local\Programs\Python\Python311\python.exe" arguments="-m flask run --port %HTTP_PLATFORM_PORT%" stdoutLogEnabled="true" stdoutLogFile="C:\inetpub\wwwroot\scanner\logs\app.log" />
<handlers>
<add name="HphHandler" path="*" verb="*" modules="httpPlatformHandler" resourceType="Unspecified" />
</handlers>
</system.webServer>
</configuration>`
FastCGIHandler web.config
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<handlers>
<add name="ScannerFCGIPowershellHandler" path="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" verb="*" modules="CgiModule" scriptProcessor="C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" resourceType="Unspecified" requireAccess="Execute" />
<add name="ScannerFCGI" path="*" verb="*" modules="FastCgiModule" scriptProcessor="C:\inetpub\wwwroot\scanner\env\Scripts\python.exe|C:\inetpub\wwwroot\scanner\env\Lib\site-packages\wfastcgi.py" resourceType="Unspecified" requireAccess="Script" />
</handlers>
</system.webServer>
<appSettings>
<add key="WSGI_HANDLER" value="app.app" /> <!-- {name_o`your text`f_file}.{name_of_flask_app}-->
<add key="PYTHONPATH" value="C:\inetpub\wwwroot\scanner" />
<add key="WSGI_LOG" value="C:\inetpub\wwwroot\scanner\logs\app.log" />
</appSettings>
</configuration>