# Sample report: DVTA (Damn Vulnerable Thick Client Application)

This folder contains a **real, unedited TCPK v2.1.0 audit report** of
[DVTA](https://github.com/secvulture/dvta) -- a public, intentionally vulnerable
C# .NET thick-client application built for training. It is included so you can see
exactly what TCPK produces on a known-vulnerable target, without installing anything.

**Nothing here is hand-written or fabricated.** Every finding, score, and evidence label
was generated by the tool. Some findings are labelled `Inferred (verify)` on purpose --
that is TCPK's honest evidence ladder (a pattern match is not the same as IL/dynamic proof),
not padding.

## How it was generated

```powershell
Import-Module .\TCPK\TCPK.psd1 -Force
# DVTA compiled binaries (bin\Release: DVTA.exe, DBAccess.dll, EntityFramework.dll, ...)
Invoke-TcpkAudit -Target 'C:\ProgramData\DVTA' -Acknowledge -ScanProfile Quick
```

`-ScanProfile Quick` keeps the binary / static / IL checks and skips the whole-machine OS
enumeration, so this sample is about **the application**, not the host it was scanned on.
No hostname, account name, or installed-software inventory from the scanning machine is present.

## What TCPK found (35 findings)

| Severity | Count |
|----------|-------|
| CRITICAL | 1 |
| HIGH     | 3 |
| MEDIUM   | 8 |
| LOW      | 12 |
| INFO     | 11 |

Highlights that map to DVTA's documented vulnerabilities:

- **Hardcoded credentials + crypto material in config** -- `secrets.config-hardcoded-secret`
  (DB password), `secrets.config-hardcoded-crypto-key` (AES key), `secrets.config-hardcoded-iv`
  (AES IV). With key + IV + ciphertext together, the DB password is trivially decryptable.
- **SQL injection** -- `callsites.sql-command-construction`, Confirmed via Mono.Cecil IL.
- **Cleartext data in transit** -- `scheme.cleartext-ftp` (`ftp://192.168.56.110`) and
  `scheme.cleartext-http`.
- **Insecure local storage** -- `storage.registry-credential` (writes credentials to the registry).
- **No code obfuscation** -- `obfuscation.absent` (source is recoverable by decompiling).
- **Insecure deserialization / CSV injection / weak signing** and more.

## Files

| File | What it is |
|------|-----------|
| `report.md` | Markdown report (renders here on GitHub) |
| `index.html` | Full interactive HTML report (open in a browser) |
| `intel.html` | Self-contained program-intelligence dashboard |
| `findings.json` | Machine-readable findings |
| `report.sarif` | SARIF 2.1.0 (GitHub code-scanning format) |
| `sbom.cdx.json` | CycloneDX software bill of materials |
| `report.xlsx` | Multi-sheet Excel report |
| `coverage.json` | Which checks ran / were gated / skipped this run |

## Attribution and scope

DVTA is a third-party project by Suryaprakash Nalluri (SecVulture),
<https://github.com/secvulture/dvta>, under its own license. **Only TCPK's report output is
included here -- the DVTA source/binaries are not redistributed in this repo.** DVTA is used
purely as an authorized, public test target to demonstrate TCPK. Run TCPK only against software
you own or are explicitly authorized to test.