You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Oct 14, 2020. It is now read-only.
The OWASP Amass Project has developed a tool to help information security professionals perform network mapping of attack surfaces and perform external asset discovery using open source information gathering and active reconnaissance techniques. To learn more about the Amass scanner itself visit [OWASP_Amass_Project] or [Amass GitHub].
A set of examples can be found in the [examples](./examples) folder.
25
+
* Example *secureCodeBox.io*[scan](./examples/secureCodeBox.io/scan.yaml) and [findings](./examples/secureCodeBox.io/findings.yaml)
26
+
* Example *example.com*[scan](./examples/secureCodeBox.io/scan.yaml) and [findings](./examples/secureCodeBox.io/findings.yaml)
27
+
28
+
## Configuration
29
+
30
+
The follwing security scan configuration example are based on the [Amass User Guide], please take a look at the original documentation for more configuration examples.
31
+
32
+
* The most basic use of the tool for subdomain enumeration: `amass enum -d example.com`
33
+
* Typical parameters for DNS enumeration: `amass enum -v -src -ip -brute -min-for-recursive 2 -d example.com`
kube-hunter hunts for security weaknesses in Kubernetes clusters. The tool was developed to increase awareness and visibility for security issues in Kubernetes environments. You should NOT run kube-hunter on a Kubernetes cluster that you don't own!
9
+
10
+
To learn more about the kube-hunter scanner itself visit [kube-hunter GitHub] or [kube-hunter Website].
11
+
12
+
<!-- end -->
13
+
14
+
## Deployment
15
+
16
+
The kube-hunter ScanType can be deployed via helm.
A set of examples can be found in the [examples](./examples) folder.
25
+
* Example *in-cluster*[scan](./examples/in-cluster/scan.yaml) and [findings](./examples/in-cluster/findings.yaml)
26
+
27
+
## Configuration
28
+
29
+
The follwing security scan configuration example are based on the [kube-hunter Documentation], please take a look at the original documentation for more configuration examples.
30
+
31
+
* To specify remote machines for hunting, select option 1 or use the --remote option. Example: `kube-hunter --remote some.node.com`
32
+
* To specify interface scanning, you can use the --interface option (this will scan all of the machine's network interfaces). Example: `kube-hunter --interface`
33
+
* To specify a specific CIDR to scan, use the --cidr option. Example: `kube-hunter --cidr 192.168.0.0/24`
34
+
35
+
## Development
36
+
37
+
### Local setup
38
+
1. Clone the repository `git clone git@github.com:secureCodeBox/secureCodeBox-v2-alpha.git`
39
+
2. Ensure you have node.js installed
40
+
* On MacOs with brew package manager: `brew install node`
41
+
42
+
### Parser Development
43
+
44
+
1. Install the dependencies `npm install`
45
+
2. Update the parser function here: `./parser/parser.js`
46
+
3. Update the parser tests here: `./parser/parser.test.js`
"location": "Local to Pod(scan-kube-hunter-in-cluster-4rfff)",
42
+
"vid": "None",
43
+
"category": "Access Risk",
44
+
"severity": "low",
45
+
"vulnerability": "CAP_NET_RAW Enabled",
46
+
"description": "CAP_NET_RAW is enabled by default for pods. If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node",
47
+
"evidence": "",
48
+
"hunter": "Pod Capabilities Hunter"
49
+
},
50
+
{
51
+
"location": "Local to Pod(scan-kube-hunter-in-cluster-4rfff)",
52
+
"vid": "None",
53
+
"category": "Access Risk",
54
+
"severity": "low",
55
+
"vulnerability": "Access to pod's secrets",
56
+
"description": " Accessing the pod's secrets within a compromised pod might disclose valuable data to a potential attacker",
Nikto is a free software command-line vulnerability scanner that scans webservers for dangerous files/CGIs, outdated server software and other problems. It performs generic and server type specific checks. It also captures and prints any cookies received. To learn more about the Nikto scanner itself visit [cirt.net] or [Nikto GitHub].
11
+
12
+
<!-- end -->
13
+
14
+
## Deployment
15
+
16
+
The Nikto ScanType can be deployed via helm.
17
+
18
+
```bash
19
+
helm upgrade --install nikto ./integrations/nikto/
20
+
```
21
+
22
+
## Examples
23
+
24
+
A set of examples can be found in the [examples](./examples) folder.
25
+
* Example *secureCodeBox.io*[scan](./examples/secureCodeBox.io/scan.yaml) and [findings](./examples/secureCodeBox.io/findings.yaml)
26
+
27
+
## Configuration
28
+
29
+
The follwing security scan configuration example are based on the [Nikto Documentation](https://cirt.net/nikto2-docs/usage.html#id2780332), please take a look at the original documentation for more configuration examples.
30
+
31
+
* The most basic Nikto scan requires simply a host to target, since port 80 is assumed if none is specified. The host can either be an IP or a hostname of a machine, and is specified using the -h (-host) option. This will scan the IP 192.168.0.1 on TCP port 80: `-h 192.168.0.1`
32
+
* To check on a different port, specify the port number with the -p (-port) option. This will scan the IP 192.168.0.1 on TCP port 443: `-h 192.168.0.1 -p 443`
33
+
* Hosts, ports and protocols may also be specified by using a full URL syntax, and it will be scanned: `-h https://192.168.0.1:443/`
34
+
* Nikto can scan multiple ports in the same scanning session. To test more than one port on the same host, specify the list of ports in the -p (-port) option. Ports can be specified as a range (i.e., 80-90), or as a comma-delimited list, (i.e., 80,88,90). This will scan the host on ports 80, 88 and 443: `-h 192.168.0.1 -p 80,88,443`
35
+
36
+
Nikto also has a comprehensive list of [command line options documented](https://cirt.net/nikto2-docs/options.html) which maybe useful to use.
37
+
38
+
* Scan tuning can be used to decrease the number of tests performed against a target. By specifying the type of test to include or exclude, faster, focused testing can be completed. This is useful in situations where the presence of certain file types are undesired -- such as XSS or simply "interesting" files. Test types can be controlled at an individual level by specifying their identifier to the -T (-Tuning) option. In the default mode, if -T is invoked only the test type(s) specified will be executed. For example, only the tests for "Remote file retrieval" and "Command execution" can performed against the target: `192.168.0.1 -T 58`
39
+
* 0 - File Upload. Exploits which allow a file to be uploaded to the target server.
40
+
* 1 - Interesting File / Seen in logs. An unknown but suspicious file or attack that has been seen in web server logs (note: if you have information regarding any of these attacks, please contact CIRT, Inc.).
41
+
* 2 - Misconfiguration / Default File. Default files or files which have been misconfigured in some manner. This could be documentation, or a resource which should be password protected.
42
+
* 3 - Information Disclosure. A resource which reveals information about the target. This could be a file system path or account name.
43
+
* 4 - Injection (XSS/Script/HTML). Any manner of injection, including cross site scripting (XSS) or content (HTML). This does not include command injection.
44
+
* 5 - Remote File Retrieval - Inside Web Root. Resource allows remote users to retrieve unauthorized files from within the web server's root directory.
45
+
* 6 - Denial of Service. Resource allows a denial of service against the target application, web server or host (note: no intentional DoS attacks are attempted).
46
+
* 7 - Remote File Retrieval - Server Wide. Resource allows remote users to retrieve unauthorized files from anywhere on the target.
47
+
* 8 - Command Execution / Remote Shell. Resource allows the user to execute a system command or spawn a remote shell.
48
+
* 9 - SQL Injection. Any type of attack which allows SQL to be executed against a database.
49
+
* a - Authentication Bypass. Allows client to access a resource it should not be allowed to access.
50
+
* b - Software Identification. Installed software or program could be positively identified.
51
+
* c - Remote source inclusion. Software allows remote inclusion of source code.
52
+
* x - Reverse Tuning Options. Perform exclusion of the specified tuning type instead of inclusion of the specified tuning type
53
+
54
+
## Development
55
+
56
+
### Local setup
57
+
1. Clone the repository `git clone git@github.com:secureCodeBox/secureCodeBox-v2-alpha.git`
58
+
2. Ensure you have node.js installed
59
+
* On MacOs with brew package manager: `brew install node`
60
+
61
+
### Parser Development
62
+
63
+
1. Install the dependencies `npm install`
64
+
2. Update the parser function here: `./parser/parser.js`
65
+
3. Update the parser tests here: `./parser/parser.test.js`
0 commit comments