Download "Debrief" PDF report via API

[L015H4CK]

Hello everyone,

I am working with CALDERA for quite a while now.

Currently I am trying to write small helper scripts that allow the automation of CALDERA tasks and ease its usage, e.g. to allow inexperienced users to run operations using the command line. I have used the official api documentation, the Swagger UI and its APIv2 documentation to write my scripts and so far everything works as expected (sidenote: If I am not mistaken, the official api documentation is a little outdated).

Now my question: Is it possible to download the PDF report generated by the debrief-plugin via the API? I did not find any info about this and looking into the code of the debrief-plugin I did not find a quick and simple way to integrate the functionality into a python script for simple execution without the UI.

Thank you for any suggestions and answers!

Update (1):
What I got so far:

By inspecting the respective buttons in the debrief user interface I found out, that by clicking the button a downloadPDF/downloadJSON java script (I think) function is called. Following the function I got to the following requests to the API:

apiV2('POST', '/plugin/debrief/json', { 'operations': this.selectedOperationIds }).then((data) => {downloadJson(data.filename, data);

I found out some other thing following the funciton calls and with the knowledge of CALDERA I have so far I tried the following call to the API: curl -X 'POST' 'http://127.0.0.1:8888/plugin/debrief/json' -H 'accept: application/json' -H 'Content-Type: application/json' -d "{'operations': ['125aea47-9e3c-4e2a-920f-19ec1443339b']}" -L. Now, at this point I get 405: Method Not Allowed.

Still open and happy for any suggestions or answers 😃

Update (2):
Another update.

I managed to download the JSON report via curl/api with the following command:
curl -X 'POST' 'http://localhost:8888/plugin/debrief/json' -H 'accept: application/json' -H 'Content-Type: application/json' -d '{"operations": ["125aea47-9e3c-4e2a-920f-19ec1443339b"]}' -H 'KEY: ADMIN123'

Executing the same curl command with /plugin/debrief/pdf resulted in 500 Internal Server Error. Server got itself in trouble. Then I spend some time in the network analysis part of the browser's debugger and found the posted request for the PDF report.
I was right with most of the request, but the data part is much larger for the PDF file.. Additionally to the operation IDs it requires the needed "report_sections" (no problem), a "header-logo" (also no problem) and a "graphs" section with the following elements: "attackpath", "fact", "steps", "tactic" and "technique" - each of them encoded.

When executing curl -X 'POST' 'http://localhost:8888/plugin/debrief/pdf' -H 'accept: application/json' -H 'Content-Type: application/json' -H 'KEY: ADMIN123' -d '{"operations":["0f4c3c67-845e-49a0-927e-90ed33c04123"], "graphs": {}, "header-logo": "", "report-sections": ["main-summary", "statistics", "agents"]}' I successfully got the JSON file containing the pdf_bytes. Note that this is a very basic report without the nice graphs etc.

So.. now my follow up question would (still) be how to easily access and download the PDF report from CALDERA 😄 I do not really believe that I am on the right track here and a more straight forward method does exist. Thank you for reading and any answers/suggestions!

Edit: I am aware of the possibility to download the json report via curl http://192.168.57.18:8888/api/v2/operations/125aea47-9e3c-4e2a-920f-19ec1443339b/report. The above method to download the json report was just used to try to get the PDF report in the same manner.

[elegantmoose]

@L015H4CK Good notes. Do you want to open feature requests for these so we can track? (as theyre pretty reasonable requests).

And yes the "ReadTheDocs" for the REST API is not updated as per note on that page:

Note: The original REST API has been deprecated. The new REST API v2 has been released, with documentation available here after server startup. Alternatively, this can be viewed by scrolling to the bottom of the CALDERA navigation menu and selecting “api docs.”

[L015H4CK]

Thank you for your answer! I guess this means that it is not possible at the moment.

I just opened a new feature request.