adding generic-cms from OSS19

this one needs a lot of work! use it as a contribution case example!

Author: jmarcil

Attack Tree/generic-cms.plantuml

@@ -0,0 +1,35 @@
+@startuml
+skinparam monochrome true
+skinparam defaultTextAlignment center
+
+' Root goals
+agent "Steal confidential data" as rootgoal1
+agent "Recon for other attacks" as rootgoal2
+
+' Sub goals
+agent "Gain privileged access" as gainpriv
+rootgoal1 ---> gainpriv
+
+agent "Gather users data" as gatherusers
+rootgoal2 --> gatherusers
+
+agent "Compromise end users" as compromiseenduser
+gatherusers --> compromiseenduser
+rootgoal1 ---> compromiseenduser
+
+agent "XSS" as xss
+compromiseenduser ---> xss
+
+agent "Find user password" as guessupassword
+compromiseenduser --> guessupassword
+
+agent "Brute force" as bruteforce
+guessupassword --> bruteforce
+agent "Find in password dump" as passdump
+guessupassword --> passdump
+
+gainpriv ---> xss
+
+
+
+@enduml

Attack Tree/generic-cms.plantuml.svg

@@ -0,0 +1,26 @@
+from pytm.pytm import TM, Boundary, Server, Actor, Datastore, Dataflow, SetOfProcesses
+
+tm = TM("Generic CMS example")
+tm.description = "This is a sample threat model for the Threat Model Cookbook."
+
+internet = Boundary("Internet")
+
+user = Actor("Generic/Privilege User")
+
+webserver = Server("Web Server")
+webserver.inBoundary = internet
+
+user_to_webserver = Dataflow(user, webserver, "HTTPS")
+
+db = Datastore("db")
+db.inBoundary = internet
+db_to_webserver = Dataflow(webserver, db, " ")
+
+adminuser = Actor(" admin ")
+admin_to_webserver = Dataflow(adminuser, db, "unsecure<br/>mysql<br/>connection")
+
+cdn = SetOfProcesses("CDN network")
+user_to_cdn = Dataflow(user, cdn, "HTTP")
+webserver_to_cdn = Dataflow(webserver, cdn, "Push to Bucket")
+
+tm.process()

Flow Diagram/generic-cms/generic-cms.py

@@ -0,0 +1,76 @@
+digraph tm {
+	graph [
+	fontname = Arial;
+	fontsize = 14;
+	]
+	node [
+	fontname = Arial;
+	fontsize = 14;
+	rankdir = lr;
+	]
+	edge [
+	shape = none;
+	fontname = Arial;
+	fontsize = 12;
+	]
+	labelloc = "t";
+	fontsize = 20;
+	nodesep = 1;
+
+subgraph cluster_bfaefefcfbeeafeefac {
+	graph [
+		fontsize = 10;
+		fontcolor = firebrick2;
+		style = dashed;
+		color = firebrick2;
+		label = <<i>Internet</i>>;
+	]
+
+aaedcfceefeffbdc [
+	shape = circle
+	color = black
+	label = <<table border="0" cellborder="0" cellpadding="2"><tr><td><b>Web Server</b></td></tr></table>>;
+]
+acbfeaddadeceddbbbbca [
+	shape = none;
+	color = black;
+	label = <<table sides="TB" cellborder="0" cellpadding="2"><tr><td><font color="black"><b>db</b></font></td></tr></table>>;
+]
+
+}
+
+abbfadcbfacaebcdefda [
+	shape = square;
+	label = <<table border="0" cellborder="0" cellpadding="2"><tr><td><b>Generic/Privilege User</b></td></tr></table>>;
+]
+	abbfadcbfacaebcdefda -> aaedcfceefeffbdc [
+		color = black;
+		label = <<table border="0" cellborder="0" cellpadding="2"><tr><td><font color ="black"><b>HTTPS</b></font></td></tr></table>>;
+	]
+	aaedcfceefeffbdc -> acbfeaddadeceddbbbbca [
+		color = black;
+		label = <<table border="0" cellborder="0" cellpadding="2"><tr><td><font color ="black"><b> </b></font></td></tr></table>>;
+	]
+cafbfbfeedbdeecbccebfdf [
+	shape = square;
+	label = <<table border="0" cellborder="0" cellpadding="2"><tr><td><b> admin </b></td></tr></table>>;
+]
+	cafbfbfeedbdeecbccebfdf -> acbfeaddadeceddbbbbca [
+		color = black;
+		label = <<table border="0" cellborder="0" cellpadding="2"><tr><td><font color ="black"><b>unsecure<br/>mysql<br/>connection</b></font></td></tr></table>>;
+	]
+bebdddeabdfbacdceded [
+	shape = doublecircle;
+	color = black;
+
+	label = <<table border="0" cellborder="0" cellpadding="2"><tr><td><font color="black"><b>CDN network</b></font></td></tr></table>>;
+]
+	abbfadcbfacaebcdefda -> bebdddeabdfbacdceded [
+		color = black;
+		label = <<table border="0" cellborder="0" cellpadding="2"><tr><td><font color ="black"><b>HTTP</b></font></td></tr></table>>;
+	]
+	aaedcfceefeffbdc -> bebdddeabdfbacdceded [
+		color = black;
+		label = <<table border="0" cellborder="0" cellpadding="2"><tr><td><font color ="black"><b>Push to Bucket</b></font></td></tr></table>>;
+	]
+}