Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 4943533

Browse files
nigthknightnigthknight
committed
Merge branch 'hooks' of github.com:secureCodeBox/secureCodeBox-v2-alpha into hooks
2 parents 0099dc3 + a61ae35 commit 4943533

File tree

7 files changed

+5400
-209
lines changed

7 files changed

+5400
-209
lines changed

‎hooks/nmap-subsequent-scans/Dockerfile‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# This image doesn't install the hooks dependencies, as it only has the @kubernetes/client-node dependencies which is already installed via the hook-sdk
2+
13
FROM scbexperimental/hook-sdk-nodejs:latest
24
WORKDIR /home/app/hook-wrapper/hook/
3-
COPY --chown=app:app ./hook.js ./hook.js
5+
COPY --chown=app:app hook.js scan-helpers.js ./

‎hooks/nmap-subsequent-scans/__mocks__/scan-helpers.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
module.exports.startSubsequentSecureCodeBoxScan = jest.fn();

‎hooks/nmap-subsequent-scans/hook.js‎

Lines changed: 99 additions & 208 deletions
Original file line numberDiff line numberDiff line change
@@ -1,244 +1,135 @@
1-
const k8s = require('@kubernetes/client-node');
1+
const { startSubsequentSecureCodeBoxScan } = require("./scan-helpers");
22

3-
// configure k8s client
4-
const kc = new k8s.KubeConfig();
5-
kc.loadFromDefault();
6-
7-
const k8sApiCRD = kc.makeApiClient(k8s.CustomObjectsApi);
8-
9-
async function handle({
10-
getFindings
11-
}) {
12-
3+
async function handle({ scan, getFindings }) {
134
const findings = await getFindings();
145

156
console.log(findings);
167

17-
// const sslyzeYaml = k8s.dumpYaml(sslyzeJSONString);
18-
// const sslyzeYaml = k8s.loadYaml(sslyzeScanDefinition);
19-
20-
console.log(`Found #${findings.length} findings... trying to find possible subsequent security scans.`);
8+
console.log(
9+
`Found #${findings.length} findings... trying to find possible subsequent security scans.`
10+
);
2111

2212
for (const finding of findings) {
23-
if(finding.category == "Open Port") {
24-
console.log("Found open port finding for service: " + finding.attributes.port);
25-
26-
if(finding.attributes.state = "open") {
27-
28-
// search for HTTP ports and start subsequent Nikto Scan
29-
if(finding.attributes.service == "http" ) {
30-
startNiktoScan(finding.attributes.hostname, finding.attributes.port);
31-
}
32-
33-
// search for HTTPS ports and start subsequent SSLyze Scan
34-
if(finding.attributes.service == "ssl" || finding.attributes.service == "https") {
35-
startSSLyzeScan(finding.attributes.hostname, finding.attributes.port);
36-
37-
startZAPBaselineScan(finding.attributes.hostname, finding.attributes.port);
38-
}
39-
40-
// search for HTTPS ports and start subsequent SSH Scan
41-
if(finding.attributes.service == "ssh" ) {
42-
startSSHScan(finding.attributes.hostname, finding.attributes.port);
43-
}
13+
if (
14+
finding.category === "Open Port" &&
15+
finding.attributes.state === "open"
16+
) {
17+
const hostname = finding.attributes.hostname;
18+
const port = finding.attributes.port;
19+
20+
console.log(
21+
"Found open port finding for service: " + finding.attributes.port
22+
);
23+
24+
// search for HTTP ports and start subsequent Nikto Scan
25+
if (finding.attributes.service === "http") {
26+
await startNiktoScan({
27+
parentScan: scan,
28+
hostname,
29+
port,
30+
});
31+
}
32+
33+
// search for HTTPS ports and start subsequent SSLyze Scan
34+
if (
35+
finding.attributes.service === "ssl" ||
36+
finding.attributes.service === "https"
37+
) {
38+
await startSSLyzeScan({
39+
parentScan: scan,
40+
hostname,
41+
port,
42+
});
43+
44+
await startZAPBaselineScan({
45+
parentScan: scan,
46+
hostname,
47+
port,
48+
});
49+
}
50+
51+
// search for HTTPS ports and start subsequent SSH Scan
52+
if (finding.attributes.service === "ssh") {
53+
await startSSHScan({
54+
parentScan: scan,
55+
hostname,
56+
port,
57+
});
4458
}
4559
}
4660
}
47-
48-
// const k8sApi = kc.makeApiClient(k8s.CoreV1Api);
49-
50-
// console.log("list namespaced Pods")
51-
// k8sApi.listNamespacedPod('default').then((res) => {
52-
// console.log(res.body);
53-
// });
54-
55-
// const k8sApiCRD = kc.makeApiClient(k8s.CustomObjectsApi);
56-
57-
// // found at: https://github.com/kubernetes-client/javascript/issues/144
58-
// console.log("list namespaced CRDs")
59-
// k8sApiCRD.listNamespacedCustomObject(
60-
// 'execution.experimental.securecodebox.io',
61-
// 'v1',
62-
// 'default',
63-
// 'scans',
64-
// 'false'
65-
// ).then((res) => {
66-
// console.log(res.body);
67-
// });
6861
}
6962

7063
/**
7164
* Creates a new subsequent SCB ZAP Scan for the given hostname.
72-
* @param {*} hostname The hostname to start a new subsequent ZAP scan for.
73-
* @param {*} port The port to start a new subsequent ZAP scan for.
65+
* @param {string} hostname The hostname to start a new subsequent ZAP scan for.
66+
* @param {string} port The port to start a new subsequent ZAP scan for.
7467
*/
75-
function startZAPBaselineScan(hostname, port) {
76-
console.log(" --> starting subsequent ZAP Scan for host: " + hostname + ":" + port);
77-
78-
const zapScanDefinition = {
79-
apiVersion: "execution.experimental.securecodebox.io/v1",
80-
kind: "Scan",
81-
metadata: {
82-
"name": "zap-" + hostname.toLowerCase(),
83-
"labels": {
84-
"organization": "secureCodeBox"
85-
}
86-
},
87-
spec: {
88-
"scanType": "zap-baseline",
89-
"parameters": [
90-
"-t",
91-
"https://" + hostname + ":" + port
92-
]
93-
}
94-
};
95-
96-
// Starting another subsequent sslyze scan based on the nmap results
97-
// found at: https://github.com/kubernetes-client/javascript/blob/79736b9a608c18d818de61a6b44503a08ea3a78f/src/gen/api/customObjectsApi.ts#L209
98-
k8sApiCRD.createNamespacedCustomObject(
99-
'execution.experimental.securecodebox.io',
100-
'v1',
101-
'default',
102-
'scans',
103-
zapScanDefinition,
104-
'false'
105-
).then((res) => {
106-
console.log(res.body);
107-
})
108-
.catch((e) => {
109-
console.log(e);
68+
async function startZAPBaselineScan({ parentScan, hostname, port }) {
69+
console.log(
70+
" --> starting subsequent ZAP Scan for host: " + hostname + ":" + port
71+
);
72+
73+
await startSubsequentSecureCodeBoxScan({
74+
parentScan,
75+
name: `zap-${hostname.toLowerCase()}`,
76+
scanType: "zap-baseline",
77+
parameters: ["-t", "https://" + hostname + ":" + port],
11078
});
11179
}
11280

11381
/**
11482
* Creates a new subsequent SCB SSH Scan for the given hostname.
115-
* @param {*} hostname The hostname to start a new subsequent SSH scan for.
116-
* @param {*} port The port to start a new subsequent SSH scan for.
83+
* @param {string} hostname The hostname to start a new subsequent SSH scan for.
84+
* @param {string} port The port to start a new subsequent SSH scan for.
11785
*/
118-
function startSSHScan(hostname, port) {
119-
console.log(" --> starting subsequent SSH Scan for host: " + hostname + ":" + port);
120-
121-
const sshScanDefintion = {
122-
"apiVersion": "execution.experimental.securecodebox.io/v1",
123-
"kind": "Scan",
124-
"metadata": {
125-
"name": "ssh-" + hostname.toLowerCase(),
126-
"labels": {
127-
"organization": "secureCodeBox"
128-
}
129-
},
130-
"spec": {
131-
"scanType": "ssh-scan",
132-
"parameters": [
133-
"-t",
134-
hostname
135-
]
136-
}
137-
};
138-
139-
// Starting another subsequent sslyze scan based on the nmap results
140-
// found at: https://github.com/kubernetes-client/javascript/blob/79736b9a608c18d818de61a6b44503a08ea3a78f/src/gen/api/customObjectsApi.ts#L209
141-
k8sApiCRD.createNamespacedCustomObject(
142-
'execution.experimental.securecodebox.io',
143-
'v1',
144-
'default',
145-
'scans',
146-
sshScanDefintion,
147-
'false'
148-
).then((res) => {
149-
console.log(res.body);
150-
})
151-
.catch((e) => {
152-
console.log(e);
86+
async function startSSHScan({ parentScan, hostname, port }) {
87+
console.log(
88+
" --> starting subsequent SSH Scan for host: " + hostname + ":" + port
89+
);
90+
91+
await startSubsequentSecureCodeBoxScan({
92+
parentScan,
93+
name: `ssh-${hostname.toLowerCase()}`,
94+
scanType: "ssh-scan",
95+
parameters: ["-t", hostname],
15396
});
15497
}
15598

15699
/**
157100
* Creates a new subsequent SCB Nikto Scan for the given hostname.
158-
* @param {*} hostname The hostname to start a new subsequent Nikto scan for.
159-
* @param {*} port The port to start a new subsequent Nikto scan for.
101+
* @param {string} hostname The hostname to start a new subsequent Nikto scan for.
102+
* @param {string} port The port to start a new subsequent Nikto scan for.
160103
*/
161-
function startNiktoScan(hostname, port) {
162-
console.log(" --> starting subsequent Nikto Scan for host: " + hostname + ":" + port);
163-
164-
const niktoScanDefinition = {
165-
"apiVersion": "execution.experimental.securecodebox.io/v1",
166-
"kind": "Scan",
167-
"metadata": {
168-
"name": "nikto-" + hostname.toLowerCase(),
169-
"labels": {
170-
"organization": "secureCodeBox"
171-
}
172-
},
173-
"spec": {
174-
"scanType": "nikto",
175-
"parameters": [
176-
"-h",
177-
"https://" + hostname,
178-
"-Tuning",
179-
"1,2,3,5,7,b"
180-
]
181-
}
182-
};
183-
184-
// Starting another subsequent sslyze scan based on the nmap results
185-
// found at: https://github.com/kubernetes-client/javascript/blob/79736b9a608c18d818de61a6b44503a08ea3a78f/src/gen/api/customObjectsApi.ts#L209
186-
k8sApiCRD.createNamespacedCustomObject(
187-
'execution.experimental.securecodebox.io',
188-
'v1',
189-
'default',
190-
'scans',
191-
niktoScanDefinition,
192-
'false'
193-
).then((res) => {
194-
console.log(res.body);
195-
})
196-
.catch((e) => {
197-
console.log(e);
104+
async function startNiktoScan({ parentScan, hostname, port }) {
105+
console.log(
106+
" --> starting subsequent Nikto Scan for host: " + hostname + ":" + port
107+
);
108+
109+
await startSubsequentSecureCodeBoxScan({
110+
parentScan,
111+
name: `nikto-${hostname.toLowerCase()}`,
112+
scanType: "nikto",
113+
parameters: ["-h", "https://" + hostname, "-Tuning", "1,2,3,5,7,b"],
198114
});
199115
}
200116

201117
/**
202118
* Creates a new subsequent SCB SSLyze Scan for the given hostname.
203-
* @param {*} hostname The hostname to start a new subsequent SSLyze scan for.
204-
* @param {*} port The port to start a new subsequent SSLyze scan for.
119+
* @param {string} hostname The hostname to start a new subsequent SSLyze scan for.
120+
* @param {string} port The port to start a new subsequent SSLyze scan for.
205121
*/
206-
function startSSLyzeScan(hostname, port) {
207-
console.log(" --> starting subsequent SSLyze Scan for host: " + hostname + ":" + port);
208-
209-
const sslyzeScanDefinition = {
210-
apiVersion: 'execution.experimental.securecodebox.io/v1',
211-
kind: 'Scan',
212-
metadata: {
213-
"name": "sslyze-" + hostname.toLowerCase(),
214-
"labels": {
215-
"organization": "secureCodeBox"
216-
}
217-
},
218-
"spec": {
219-
"scanType": "sslyze",
220-
"parameters": [
221-
"--regular",
222-
hostname
223-
]
224-
}
225-
};
226-
227-
// Starting another subsequent sslyze scan based on the nmap results
228-
// found at: https://github.com/kubernetes-client/javascript/blob/79736b9a608c18d818de61a6b44503a08ea3a78f/src/gen/api/customObjectsApi.ts#L209
229-
k8sApiCRD.createNamespacedCustomObject(
230-
'execution.experimental.securecodebox.io',
231-
'v1',
232-
'default',
233-
'scans',
234-
sslyzeScanDefinition,
235-
'false'
236-
).then((res) => {
237-
console.log(res.body);
238-
})
239-
.catch((e) => {
240-
console.log(e);
241-
});
122+
async function startSSLyzeScan({ parentScan, hostname, port }) {
123+
console.log(
124+
" --> starting subsequent SSLyze Scan for host: " + hostname + ":" + port
125+
);
126+
127+
await startSubsequentSecureCodeBoxScan({
128+
parentScan,
129+
name: `sslyze-${hostname.toLowerCase()}`,
130+
scanType: "sslyze",
131+
parameters: ["--regular", hostname],
132+
});
242133
}
243134

244135
module.exports.handle = handle;

0 commit comments

Comments
 (0)