SAPstract

SAPstract combines two independent SAP security tools:

• read-only host posture collectors for Linux/Unix and Windows; and
• a dependency-free Python library and CLI for SAP Secure Storage in the File System (SSFS).

The collectors discover local SAP systems, services, connections, configuration, permissions, and secure-store metadata. They produce a self-contained HTML report plus JSON evidence. See the synthetic example HTML report for a showcase with no production data or credentials.

Important: Treat the report as a footprint, not a metric to get to zero.

Linux/Unix (Bash 4+):

chmod 750 SAPaudit.sh
sudo ./SAPaudit.sh --output-dir ./reports

Windows PowerShell 5.1+ or PowerShell 7+:

Set-ExecutionPolicy -Scope Process Bypass
.\SAPaudit.ps1 -OutputDirectory C:\Audit\SAPstract

Elevation is recommended for complete process, socket, ACL, and protected-path coverage. Non-elevated runs are supported and record the resulting gaps.

Common options:

Offline example:

sudo mount -o ro /dev/mapper/sap-root /mnt/sap-root
sudo ./SAPaudit.sh --root /mnt/sap-root --output-dir ./reports/offline

• SAP systems, processes, services, listeners, and observed connections
• Service topology, capabilities, and database-placement evidence
• Security-relevant profiles and SAP ACL files
• Standard paths, ownership, permissions, hashes, and Windows signatures
• SSFS, PSE, Credv2, keystore, transport, trace, and SAP GUI history metadata
• Prioritized findings with evidence, impact, remediation, and references
• Collection coverage and authenticated or active checks still required

Both collectors emit schema sapstract-audit/v2. The HTML is self-contained, print-friendly, and supports light/dark themes. JSON keeps the same evidence in stable top-level arrays for automation.

The score is a remediation triage aid, not a probability of compromise or an SAP certification. A report with no findings can still have important coverage gaps.

The collectors do not connect to other hosts, call SAP administrative methods, try credentials, exploit vulnerabilities, decrypt secure stores, expose secret values, or change the system. Reports can still contain sensitive topology, usernames, paths, profile values, and hashes; protect them as audit evidence.

For the complete rule and research model, see:

• Rule catalog
• Topology model
• OWASP CBAS coverage
• Security-source gap analysis

The separate python/ component is an MIT-licensed Python 3.11+ package for reading, writing, validating, inspecting, and rotating SAP SSFS stores. It does not depend on PySAP, Scapy, or cryptography.

Run it from the checkout:

cd python
PYTHONPATH=src python3 -m sapstract --help

Or install it:

python3 -m pip install ./python
sapstract --version

Start with the package guide, API reference, and operations guide. Unlike the passive collectors, this package can return clear bytes and modify stores; use protected inputs, matched backups, and official SAP validation tools.

bash -n SAPaudit.sh
./tests/test-audit-correlation.sh
./SAPaudit.sh --help

$null = [System.Management.Automation.Language.Parser]::ParseFile(
  (Resolve-Path .\SAPaudit.ps1), [ref]$null, [ref]$parseErrors
)
$parseErrors
.\tests\Test-AuditCorrelation.ps1

The host collectors and repository documentation are GPL-3.0; see LICENSE. The Python SSFS component is MIT-licensed; see python/LICENSE.