community_10_modules_opsec_scorer - grisuno/LazyOwn GitHub Wiki

modules: opsec_scorer

Community 10 | 20 files | cohesion 0.37

Definition

This community groups 20 file(s) rooted at modules with dominant language py (cohesion 0.37). Central symbols: AESdecrypt, AESencrypt, AutoCryptoConfig, AutoCryptoEngine, Bogus, BridgeCatalog, CrackResult, Dummy. Core file: tests/test_core.py (47 symbols). Documented purpose: Automatic encryption of sensitive session data on app open/close. Before this module the operator had to manually run lazyenc.py encrypt and ``lazyenc.py d.

Files

File	Language	Layer	Symbols	Doc
`cli/auto_crypto.py`	py	utility	13	yes
`cli/commands/opsec_cleanup.py`	py	utility	9	yes
`cli/commands/security.py`	py	utility	8	yes
`core/credential_vault.py`	py	utility	8	yes
`core/crypto.py`	py	utility	7	yes
`core/protocols.py`	py	utility	12	yes
`modules/forensic_cleaner.py`	py	utility	8	yes
`modules/hash_cracker.py`	py	utility	17	yes
`modules/log_tamper.py`	py	utility	9	yes
`modules/memory_cleaner.py`	py	utility	7	yes
`modules/network_opsec.py`	py	utility	12	yes
`modules/opsec_scorer.py`	py	utility	36	yes
`modules/rootkit/rootkit.c`	c	utility	13	yes
`modules/timestomper.py`	py	utility	12	yes
`tests/test_auto_crypto.py`	py	testing	22	yes
`tests/test_core.py`	py	testing	47	yes
`tests/test_credential_vault.py`	py	testing	16	yes
`tests/test_hash_cracker.py`	py	testing	22	yes
`tests/test_opsec_scorer.py`	py	testing	13	yes
`tests/test_opsec_scorer_consolidated.py`	py	testing	22	yes

Key Symbols

AutoCryptoConfig (class, cli/auto_crypto.py:48) class AutoCryptoConfig - Centralised configuration for automatic session encryption.
AutoCryptoEngine (class, cli/auto_crypto.py:77) class AutoCryptoEngine - Encrypt and decrypt sensitive session files with a derived key.
__init__ (method, cli/auto_crypto.py:85) def __init__(self, config)
enabled (method, cli/auto_crypto.py:90) def enabled(self) - Whether the engine performs any I/O.
is_encrypted (method, cli/auto_crypto.py:95) def is_encrypted(self) - Check whether session data appears encrypted.
encrypt_session (method, cli/auto_crypto.py:124) def encrypt_session(self) - Encrypt all protected session files.
decrypt_session (method, cli/auto_crypto.py:174) def decrypt_session(self) - Decrypt all protected session files.
has_password (method, cli/auto_crypto.py:239) def has_password(self) - Return True when the configured provider yields a password now.
_get_password (method, cli/auto_crypto.py:251) def _get_password(self)
_load_or_create_salt (method, cli/auto_crypto.py:260) def _load_or_create_salt(self)
_derive_key (method, cli/auto_crypto.py:291) def _derive_key(password, salt)
build_password_provider_from_cli_login (function, cli/auto_crypto.py:297) def build_password_provider_from_cli_login() - Return a password provider that reads the CLI login session.
_provider (function, cli/auto_crypto.py:310) def _provider()
OpsecCleanupCommandSet (class, cli/commands/opsec_cleanup.py:19) class OpsecCleanupCommandSet(LazyOwnCommandSet) - OPSEC scoring, log tampering, forensic cleaning, timestomping, memory/network OPSEC.
do_opsec_score (method, cli/commands/opsec_cleanup.py:25) def do_opsec_score(self, line) - Real-time OPSEC risk assessment with contextual action gating (v2).
do_log_tamper (method, cli/commands/opsec_cleanup.py:97) def do_log_tamper(self, line) - Cross-platform log clearing commands.
do_forensic_clean (method, cli/commands/opsec_cleanup.py:162) def do_forensic_clean(self, line) - Clean forensic artifacts — Prefetch, Shimcache, Amcache, Jump Lists, etc.
do_timestomp (method, cli/commands/opsec_cleanup.py:219) def do_timestomp(self, line) - Manipulate file MACB timestamps to evade forensic timeline analysis.
do_memory_clean (method, cli/commands/opsec_cleanup.py:288) def do_memory_clean(self, line) - Clean memory artifacts — Kerberos tickets, clipboard, env vars, credentials.
do_network_opsec (method, cli/commands/opsec_cleanup.py:342) def do_network_opsec(self, line) - Network OPSEC — proxy chains, DoH, canary detection, traffic analysis.
do_auditd_disable (method, cli/commands/opsec_cleanup.py:445) def do_auditd_disable(self, line) - Generate commands to disable Linux auditd.
do_sysmon_disable (method, cli/commands/opsec_cleanup.py:468) def do_sysmon_disable(self, line) - Generate commands to disable Windows Sysmon.
SecurityCommandSet (class, cli/commands/security.py:20) class SecurityCommandSet(LazyOwnCommandSet) - OPSEC scoring, credential vault, and hash cracking commands.
do_opsec (method, cli/commands/security.py:26) def do_opsec(self, line) - Score OPSEC risk for a LazyOwn command before execution.
do_seal_credentials (method, cli/commands/security.py:106) def do_seal_credentials(self, _line) - Encrypt all sensitive values in payload.json using AES-256-GCM.
do_rotate_aes (method, cli/commands/security.py:127) def do_rotate_aes(self, _line) - Generate a new AES key and re-encrypt all sealed credentials.
do_unseal_credentials (method, cli/commands/security.py:150) def do_unseal_credentials(self, _line) - Decrypt sealed credential values in payload.json for inspection.
do_crack_hashes (method, cli/commands/security.py:170) def do_crack_hashes(self, line) - Crack password hashes from a file using John the Ripper or Hashcat.
complete_opsec (method, cli/commands/security.py:267) def complete_opsec(self, text, line, begidx, endidx)
complete_crack_hashes (method, cli/commands/security.py:276) def complete_crack_hashes(self, text, line, begidx, endidx)

Internal vs External Edges

Internal resolved imports (EXTRACTED): 33
Cross-boundary resolved imports (EXTRACTED): 63

Connections

[EXTRACTED] depends_on community 10 <-> 1 (strength 0.9): Extracted import edge crosses communities: cli/auto_crypto.py imports core/logging.py.
[EXTRACTED] depends_on community 10 <-> 0 (strength 0.9): Extracted import edge crosses communities: cli/auto_crypto.py imports modules/cli_auth.py.

Risks

[dataflow UNCHECKED_ALLOC] cli/auto_crypto.py:272 _load_or_create_salt fd: Result of allocator stored in fd is never checked against NULL.

Open Questions

What would break if the most connected file in modules: opsec_scorer changed?
Should modules: opsec_scorer be split, given cohesion 0.37?