Improved the imperative-subsequent-scans hook (if you scan a huge range of services and ports) to prevent duplicate subsequent names if multiple ports per host serves the same service type.

Author: rfelber

hooks/imperative-subsequent-scans/hook.js

@@ -192,7 +192,7 @@ async function startZAPBaselineHttpsScan({ parentScan, hostname, port }) {
     );
     await startSubsequentSecureCodeBoxScan({
       parentScan,
-      name: `zap-https-${hostname.toLowerCase()}`,
+      name: `zap-${port}-${hostname.toLowerCase()}`,
       scanType: "zap-baseline",
       parameters: ["-t", "https://" + hostname + ":" + port],
     });
@@ -218,7 +218,7 @@ async function startSSHScan({ parentScan, hostname, port }) {
     );
     await startSubsequentSecureCodeBoxScan({
       parentScan,
-      name: `ssh-${hostname.toLowerCase()}`,
+      name: `ssh-${port}-${hostname.toLowerCase()}`,
       scanType: "ssh-scan",
       parameters: ["-t", hostname, "-p", port.toString()],
     });
@@ -245,7 +245,7 @@ async function startNiktoHttpScan({ parentScan, hostname, port }) {
     );
     await startSubsequentSecureCodeBoxScan({
       parentScan,
-      name: `nikto-http-${hostname.toLowerCase()}`,
+      name: `nikto-${port}-${hostname.toLowerCase()}`,
       scanType: "nikto",
       parameters: ["-h", "http://" + hostname, "-p", port.toString(), "-Tuning", "1,2,3,5,7,b"],
     });
@@ -272,7 +272,7 @@ async function startSSLyzeScan({ parentScan, hostname, port }) {
     );
     await startSubsequentSecureCodeBoxScan({
       parentScan,
-      name: `sslyze-${hostname.toLowerCase()}`,
+      name: `sslyze-${port}-${hostname.toLowerCase()}`,
       scanType: "sslyze",
       parameters: ["--regular", hostname+":"+port],
     });

hooks/imperative-subsequent-scans/hook.test.js

@@ -58,26 +58,26 @@ test("Should create subsequent scans for open HTTPS ports (NMAP findings)", asyn
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenCalledTimes(4);
 
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(1, {
-    name: "sslyze-foobar.com",
+    name: "sslyze-443-foobar.com",
     parameters: ["--regular", "foobar.com:443"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "sslyze",
   });
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(2, {
-    name: "zap-https-foobar.com",
+    name: "zap-443-foobar.com",
     parameters: ["-t", "https://foobar.com:443"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "zap-baseline",
   });
   // even if the HTTPS port is not running at port 443 a corresponding Sslyze scan should be created if a HTTP service is found by nmap
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(3, {
-    name: "sslyze-example.com",
+    name: "sslyze-8443-example.com",
     parameters: ["--regular", "example.com:8443"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "sslyze",
   });
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(4, {
-    name: "zap-https-example.com",
+    name: "zap-8443-example.com",
     parameters: ["-t", "https://example.com:8443"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "zap-baseline",
@@ -139,14 +139,14 @@ test("Should create subsequent scans for open HTTP ports (NMAP findings)", async
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenCalledTimes(6);
 
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(5, {
-    name: "nikto-http-foobar.com",
+    name: "nikto-80-foobar.com",
     parameters: ["-h", "http://foobar.com", "-p", "80", "-Tuning", "1,2,3,5,7,b"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "nikto",
   });
   // even if the HTTP port is not running at port 80 a corresponding Nikto scan should be created if a HTTP service is found by nmap
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(6, {
-    name: "nikto-http-example.com",
+    name: "nikto-3000-example.com",
     parameters: ["-h", "http://example.com", "-p", "3000", "-Tuning", "1,2,3,5,7,b"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "nikto",
@@ -208,14 +208,14 @@ test("Should create subsequent scans for open SSH ports (NMAP findings)", async
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenCalledTimes(8);
 
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(7, {
-    name: "ssh-foobar.com",
+    name: "ssh-22-foobar.com",
     parameters: ["-t", "foobar.com", "-p", "22"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "ssh-scan",
   });
   // even if the HTTP port is not running at port 80 a corresponding Nikto scan should be created if a HTTP service is found by nmap
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(8, {
-    name: "ssh-example.com",
+    name: "ssh-23454-example.com",
     parameters: ["-t", "example.com", "-p", "23454"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "ssh-scan",
@@ -658,31 +658,31 @@ test("Should create subsequent scans for Service which are running in custom por
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenCalledTimes(18);
 
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(13, {
-    name: "ssh-ssh.example.com",
+    name: "ssh-22000-ssh.example.com",
     parameters: ["-t", "ssh.example.com", "-p", "22000"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "ssh-scan",
   });
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(14, {
-    name: "nikto-http-http.example.com",
+    name: "nikto-8000-http.example.com",
     parameters: ["-h", "http://http.example.com", "-p", "8000", "-Tuning", "1,2,3,5,7,b"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "nikto",
   });
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(15, {
-    name: "sslyze-https.example.com",
+    name: "sslyze-3000-https.example.com",
     parameters: ["--regular", "https.example.com:3000"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "sslyze",
   });
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(16, {
-    name: "zap-https-https.example.com",
+    name: "zap-3000-https.example.com",
     parameters: ["-t", "https://https.example.com:3000"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "zap-baseline",
   });
   expect(startSubsequentSecureCodeBoxScan).toHaveBeenNthCalledWith(17, {
-    name: "sslyze-ssl.example.com",
+    name: "sslyze-8443-ssl.example.com",
     parameters: ["--regular", "ssl.example.com:8443"],
     parentScan: { metadata: { labels: { foo: "bar" } } },
     scanType: "sslyze",