Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 3dbc769

Browse files
J12934J12934
committed
Add nikto scanner integration
1 parent cc7e910 commit 3dbc769

File tree

7 files changed

+363
-0
lines changed

7 files changed

+363
-0
lines changed

‎integrations/nikto/nikto-parse-definition.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: "execution.experimental.securecodebox.io/v1"
2+
kind: ParseDefinition
3+
metadata:
4+
name: "nikto-json"
5+
spec:
6+
handlesResultsType: nikto-json
7+
image: scbexperimental/parser-nikto

‎integrations/nikto/nikto-scan-type.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: 'execution.experimental.securecodebox.io/v1'
2+
kind: ScanType
3+
metadata:
4+
name: 'nikto'
5+
spec:
6+
extractResults:
7+
type: nikto-json
8+
location: '/home/securecodebox/nikto-results.json'
9+
jobTemplate:
10+
spec:
11+
ttlSecondsAfterFinished: 10
12+
template:
13+
spec:
14+
restartPolicy: OnFailure
15+
containers:
16+
- name: nikto
17+
image: scbexperimental/nikto:latest
18+
command:
19+
- 'nikto'
20+
- '-F'
21+
- 'json'
22+
- '-o'
23+
- '/home/securecodebox/nikto-results.json'

‎integrations/nikto/parser/Dockerfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM scbexperimental/parser-sdk-nodejs:latest
2+
WORKDIR /home/app/parser-wrapper/parser/
3+
COPY --chown=app:app ./parser.js ./parser.js

‎integrations/nikto/parser/__snapshots__/parser.test.js.snap‎

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
// Jest Snapshot v1, https://goo.gl/fbAQLP
2+
3+
exports[`parses www.securecodebox.io result file into findings 1`] = `
4+
Array [
5+
Object {
6+
"attributes": Object {
7+
"banner": "GitHub.com",
8+
"hostname": "www.securecodebox.io",
9+
"ip_address": "185.199.108.153",
10+
"method": "GET",
11+
"niktoId": 999986,
12+
"port": 443,
13+
},
14+
"category": "Nikto Finding",
15+
"description": null,
16+
"location": "https://www.securecodebox.io/",
17+
"name": "Retrieved via header: 1.1 varnish",
18+
"osi_layer": "NETWORK",
19+
"severity": "INFORMATIONAL",
20+
},
21+
Object {
22+
"attributes": Object {
23+
"banner": "GitHub.com",
24+
"hostname": "www.securecodebox.io",
25+
"ip_address": "185.199.108.153",
26+
"method": "GET",
27+
"niktoId": 999986,
28+
"port": 443,
29+
},
30+
"category": "Nikto Finding",
31+
"description": null,
32+
"location": "https://www.securecodebox.io/",
33+
"name": "Retrieved x-served-by header: cache-fra19151-FRA",
34+
"osi_layer": "NETWORK",
35+
"severity": "INFORMATIONAL",
36+
},
37+
Object {
38+
"attributes": Object {
39+
"banner": "GitHub.com",
40+
"hostname": "www.securecodebox.io",
41+
"ip_address": "185.199.108.153",
42+
"method": "GET",
43+
"niktoId": 999986,
44+
"port": 443,
45+
},
46+
"category": "Nikto Finding",
47+
"description": null,
48+
"location": "https://www.securecodebox.io/",
49+
"name": "Retrieved access-control-allow-origin header: *",
50+
"osi_layer": "NETWORK",
51+
"severity": "INFORMATIONAL",
52+
},
53+
Object {
54+
"attributes": Object {
55+
"banner": "GitHub.com",
56+
"hostname": "www.securecodebox.io",
57+
"ip_address": "185.199.108.153",
58+
"method": "GET",
59+
"niktoId": 999957,
60+
"port": 443,
61+
},
62+
"category": "X-Frame-Options Header",
63+
"description": null,
64+
"location": "https://www.securecodebox.io/",
65+
"name": "The anti-clickjacking X-Frame-Options header is not present.",
66+
"osi_layer": "NETWORK",
67+
"severity": "LOW",
68+
},
69+
Object {
70+
"attributes": Object {
71+
"banner": "GitHub.com",
72+
"hostname": "www.securecodebox.io",
73+
"ip_address": "185.199.108.153",
74+
"method": "GET",
75+
"niktoId": 999102,
76+
"port": 443,
77+
},
78+
"category": "Nikto Finding",
79+
"description": null,
80+
"location": "https://www.securecodebox.io/",
81+
"name": "The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS",
82+
"osi_layer": "NETWORK",
83+
"severity": "INFORMATIONAL",
84+
},
85+
Object {
86+
"attributes": Object {
87+
"banner": "GitHub.com",
88+
"hostname": "www.securecodebox.io",
89+
"ip_address": "185.199.108.153",
90+
"method": "GET",
91+
"niktoId": 999100,
92+
"port": 443,
93+
},
94+
"category": "Uncommon Header",
95+
"description": null,
96+
"location": "https://www.securecodebox.io/",
97+
"name": "Uncommon header 'x-timer' found, with contents: S1585519074.290715,VS0,VE1",
98+
"osi_layer": "NETWORK",
99+
"severity": "INFORMATIONAL",
100+
},
101+
Object {
102+
"attributes": Object {
103+
"banner": "GitHub.com",
104+
"hostname": "www.securecodebox.io",
105+
"ip_address": "185.199.108.153",
106+
"method": "GET",
107+
"niktoId": 999100,
108+
"port": 443,
109+
},
110+
"category": "Uncommon Header",
111+
"description": null,
112+
"location": "https://www.securecodebox.io/",
113+
"name": "Uncommon header 'x-cache' found, with contents: HIT",
114+
"osi_layer": "NETWORK",
115+
"severity": "INFORMATIONAL",
116+
},
117+
Object {
118+
"attributes": Object {
119+
"banner": "GitHub.com",
120+
"hostname": "www.securecodebox.io",
121+
"ip_address": "185.199.108.153",
122+
"method": "GET",
123+
"niktoId": 999100,
124+
"port": 443,
125+
},
126+
"category": "Uncommon Header",
127+
"description": null,
128+
"location": "https://www.securecodebox.io/",
129+
"name": "Uncommon header 'x-proxy-cache' found, with contents: MISS",
130+
"osi_layer": "NETWORK",
131+
"severity": "INFORMATIONAL",
132+
},
133+
Object {
134+
"attributes": Object {
135+
"banner": "GitHub.com",
136+
"hostname": "www.securecodebox.io",
137+
"ip_address": "185.199.108.153",
138+
"method": "GET",
139+
"niktoId": 999100,
140+
"port": 443,
141+
},
142+
"category": "Uncommon Header",
143+
"description": null,
144+
"location": "https://www.securecodebox.io/",
145+
"name": "Uncommon header 'x-fastly-request-id' found, with contents: 12821df5c3f5eb828b1a4ce7d4e3637faa71291a",
146+
"osi_layer": "NETWORK",
147+
"severity": "INFORMATIONAL",
148+
},
149+
Object {
150+
"attributes": Object {
151+
"banner": "GitHub.com",
152+
"hostname": "www.securecodebox.io",
153+
"ip_address": "185.199.108.153",
154+
"method": "GET",
155+
"niktoId": 999100,
156+
"port": 443,
157+
},
158+
"category": "Uncommon Header",
159+
"description": null,
160+
"location": "https://www.securecodebox.io/",
161+
"name": "Uncommon header 'x-github-request-id' found, with contents: DB72:2841:1B0932:23C885:5E8119E0",
162+
"osi_layer": "NETWORK",
163+
"severity": "INFORMATIONAL",
164+
},
165+
Object {
166+
"attributes": Object {
167+
"banner": "GitHub.com",
168+
"hostname": "www.securecodebox.io",
169+
"ip_address": "185.199.108.153",
170+
"method": "GET",
171+
"niktoId": 999100,
172+
"port": 443,
173+
},
174+
"category": "Uncommon Header",
175+
"description": null,
176+
"location": "https://www.securecodebox.io/",
177+
"name": "Uncommon header 'x-served-by' found, with contents: cache-fra19151-FRA",
178+
"osi_layer": "NETWORK",
179+
"severity": "INFORMATIONAL",
180+
},
181+
Object {
182+
"attributes": Object {
183+
"banner": "GitHub.com",
184+
"hostname": "www.securecodebox.io",
185+
"ip_address": "185.199.108.153",
186+
"method": "GET",
187+
"niktoId": 999955,
188+
"port": 443,
189+
},
190+
"category": "Nikto Finding",
191+
"description": null,
192+
"location": "https://www.securecodebox.io/",
193+
"name": "The site uses SSL and Expect-CT header is not present.",
194+
"osi_layer": "NETWORK",
195+
"severity": "INFORMATIONAL",
196+
},
197+
Object {
198+
"attributes": Object {
199+
"banner": "GitHub.com",
200+
"hostname": "www.securecodebox.io",
201+
"ip_address": "185.199.108.153",
202+
"method": "GET",
203+
"niktoId": 999103,
204+
"port": 443,
205+
},
206+
"category": "X-Content-Type-Options Header",
207+
"description": null,
208+
"location": "https://www.securecodebox.io/",
209+
"name": "The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type",
210+
"osi_layer": "NETWORK",
211+
"severity": "INFORMATIONAL",
212+
},
213+
Object {
214+
"attributes": Object {
215+
"banner": "GitHub.com",
216+
"hostname": "www.securecodebox.io",
217+
"ip_address": "185.199.108.153",
218+
"method": "PUT",
219+
"niktoId": 999962,
220+
"port": 443,
221+
},
222+
"category": "Nikto Finding",
223+
"description": null,
224+
"location": "https://www.securecodebox.io/",
225+
"name": "Server banner changed from 'GitHub.com' to 'Varnish'",
226+
"osi_layer": "NETWORK",
227+
"severity": "INFORMATIONAL",
228+
},
229+
Object {
230+
"attributes": Object {
231+
"banner": "GitHub.com",
232+
"hostname": "www.securecodebox.io",
233+
"ip_address": "185.199.108.153",
234+
"method": "GET",
235+
"niktoId": 999966,
236+
"port": 443,
237+
},
238+
"category": "Nikto Finding",
239+
"description": null,
240+
"location": "https://www.securecodebox.io/",
241+
"name": "The Content-Encoding header is set to \\"deflate\\" this may mean that the server is vulnerable to the BREACH attack.",
242+
"osi_layer": "NETWORK",
243+
"severity": "INFORMATIONAL",
244+
},
245+
]
246+
`;

‎integrations/nikto/parser/__testFiles__/www.securecodebox.io.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"host":"www.securecodebox.io","ip":"185.199.108.153","port":"443","banner":"GitHub.com","vulnerabilities":[{"id": "999986","OSVDB": "0","method":"GET","url":"/","msg":"Retrieved via header: 1.1 varnish"},{"id": "999986","OSVDB": "0","method":"GET","url":"/","msg":"Retrieved x-served-by header: cache-fra19151-FRA"},{"id": "999986","OSVDB": "0","method":"GET","url":"/","msg":"Retrieved access-control-allow-origin header: *"},{"id": "999957","OSVDB": "0","method":"GET","url":"/","msg":"The anti-clickjacking X-Frame-Options header is not present."},{"id": "999102","OSVDB": "0","method":"GET","url":"/","msg":"The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS"},{"id": "999100","OSVDB": "0","method":"GET","url":"/","msg":"Uncommon header 'x-timer' found, with contents: S1585519074.290715,VS0,VE1"},{"id": "999100","OSVDB": "0","method":"GET","url":"/","msg":"Uncommon header 'x-cache' found, with contents: HIT"},{"id": "999100","OSVDB": "0","method":"GET","url":"/","msg":"Uncommon header 'x-proxy-cache' found, with contents: MISS"},{"id": "999100","OSVDB": "0","method":"GET","url":"/","msg":"Uncommon header 'x-fastly-request-id' found, with contents: 12821df5c3f5eb828b1a4ce7d4e3637faa71291a"},{"id": "999100","OSVDB": "0","method":"GET","url":"/","msg":"Uncommon header 'x-github-request-id' found, with contents: DB72:2841:1B0932:23C885:5E8119E0"},{"id": "999100","OSVDB": "0","method":"GET","url":"/","msg":"Uncommon header 'x-served-by' found, with contents: cache-fra19151-FRA"},{"id": "999955","OSVDB": "0","method":"GET","url":"/","msg":"The site uses SSL and Expect-CT header is not present."},{"id": "999103","OSVDB": "0","method":"GET","url":"/","msg":"The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type"},{"id": "999962","OSVDB": "0","method":"PUT","url":"/","msg":"Server banner changed from 'GitHub.com' to 'Varnish'"},{"id": "999966","OSVDB": "0","method":"GET","url":"/","msg":"The Content-Encoding header is set to \"deflate\" this may mean that the server is vulnerable to the BREACH attack."}]}

‎integrations/nikto/parser/parser.js‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
const INFORMATIONAL = 'INFORMATIONAL';
2+
const LOW = 'LOW';
3+
const MEDIUM = 'MEDIUM';
4+
const HIGH = 'HIGH';
5+
/**
6+
* Sorts Nikto findings into Categories
7+
*
8+
* @param {string} category
9+
*/
10+
function categorize({ id }) {
11+
if (id === 999957) {
12+
return ['X-Frame-Options Header', LOW];
13+
} else if (id === 'X-XSS-Protection') {
14+
return ['X-XSS-Protection', LOW];
15+
} else if (id === 999100) {
16+
return ['Uncommon Header', INFORMATIONAL];
17+
} else if (id === 999103) {
18+
return ['X-Content-Type-Options Header', INFORMATIONAL];
19+
} else if (id === 521000) {
20+
return ['Path Traversal', HIGH];
21+
} else if (id >= 600000 && id < 700000) {
22+
return ['Outdated Software', MEDIUM];
23+
} else if (id >= 800000 && id < 900000) {
24+
return ['Identified Software', INFORMATIONAL];
25+
} else if (id >= 0 && id < 100000) {
26+
return ['Potential Vulnerability', HIGH];
27+
} else if (id >= 500017 && id < 600000) {
28+
return ['Identified Software', INFORMATIONAL];
29+
} else if (id >= 300000 && id < 400000) {
30+
return ['Embedded Device', INFORMATIONAL];
31+
}
32+
33+
return ['Nikto Finding', INFORMATIONAL];
34+
}
35+
36+
async function parse({ host, ip, port: portString, banner, vulnerabilities }) {
37+
const port = parseInt(portString, 10);
38+
39+
return vulnerabilities.filter(Boolean).map(({ id, method, url, msg }) => {
40+
const niktoId = parseInt(id, 10);
41+
42+
const [category, severity] = categorize({ id: niktoId });
43+
44+
// We can only guess at this point. Nikto doesn't tell use anymore :(
45+
const protocol = port === 443 || port === 8443 ? 'https' : 'http';
46+
47+
return {
48+
name: msg,
49+
description: null,
50+
category,
51+
location: `${protocol}://${host}${url}`,
52+
osi_layer: 'NETWORK',
53+
severity,
54+
attributes: {
55+
ip_address: ip,
56+
hostname: host,
57+
banner,
58+
method,
59+
port,
60+
niktoId,
61+
},
62+
};
63+
});
64+
}
65+
66+
module.exports.parse = parse;

‎integrations/nikto/parser/parser.test.js‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
const fs = require('fs');
2+
const util = require('util');
3+
4+
// eslint-disable-next-line security/detect-non-literal-fs-filename
5+
const readFile = util.promisify(fs.readFile);
6+
7+
const { parse } = require('./parser');
8+
9+
test('parses www.securecodebox.io result file into findings', async () => {
10+
const fileContent = JSON.parse(
11+
await readFile(__dirname + '/__testFiles__/www.securecodebox.io.json', {
12+
encoding: 'utf8',
13+
})
14+
);
15+
16+
expect(await parse(fileContent)).toMatchSnapshot();
17+
});

0 commit comments

Comments
 (0)