Merge branch 'hooks' of github.com:secureCodeBox/secureCodeBox-v2-alpha into hooks

Author: nigthknight

.github/workflows/ci.yaml

@@ -10,7 +10,7 @@ jobs:
         run: ls
       - name: "Install npm dependencies in all parser sub projects"
         run: |
-          for dir in integrations/*/parser/
+          for dir in scanner/*/parser/
           do
               cd $dir
               if [ -f package.json ] && [ -f package-lock.json ]; then
@@ -35,7 +35,7 @@ jobs:
       - name: "Install npm test dependencies"
         run: |
           npm ci
-          cd integrations/
+          cd scanner/
           npm ci
           cd -
           cd hooks/
@@ -109,7 +109,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/parser-amass
-          path: ./integrations/amass/parser/
+          path: ./scanner/amass/parser/
           tag_with_ref: true
           tag_with_sha: true
       - uses: docker/build-push-action@v1
@@ -118,7 +118,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/parser-kube-hunter
-          path: ./integrations/kube-hunter/parser/
+          path: ./scanner/kube-hunter/parser/
           tag_with_ref: true
           tag_with_sha: true
       - uses: docker/build-push-action@v1
@@ -127,7 +127,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/parser-nikto
-          path: ./integrations/nikto/parser/
+          path: ./scanner/nikto/parser/
           tag_with_ref: true
           tag_with_sha: true
       - uses: docker/build-push-action@v1
@@ -136,7 +136,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/parser-nmap
-          path: ./integrations/nmap/parser/
+          path: ./scanner/nmap/parser/
           tag_with_ref: true
           tag_with_sha: true
       - uses: docker/build-push-action@v1
@@ -145,7 +145,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/parser-ssh-scan
-          path: ./integrations/ssh_scan/parser/
+          path: ./scanner/ssh_scan/parser/
           tag_with_ref: true
           tag_with_sha: true
       - uses: docker/build-push-action@v1
@@ -154,7 +154,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/parser-sslyze
-          path: ./integrations/sslyze/parser/
+          path: ./scanner/sslyze/parser/
           tag_with_ref: true
           tag_with_sha: true
       - uses: docker/build-push-action@v1
@@ -163,7 +163,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/parser-test-scan
-          path: ./integrations/test-scan/parser/
+          path: ./scanner/test-scan/parser/
           tag_with_ref: true
           tag_with_sha: true
       - uses: docker/build-push-action@v1
@@ -172,7 +172,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/parser-trivy
-          path: ./integrations/trivy/parser/
+          path: ./scanner/trivy/parser/
           tag_with_ref: true
           tag_with_sha: true
       - uses: docker/build-push-action@v1
@@ -181,7 +181,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/parser-zap
-          path: ./integrations/zap/parser/
+          path: ./scanner/zap/parser/
           tag_with_ref: true
           tag_with_sha: true
   hookImages:
@@ -252,7 +252,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/nmap
-          path: ./integrations/nmap/scanner/
+          path: ./scanner/nmap/scanner/
           # Note: not prefixed with a "v" as this seems to match nmap versioning standards
           tags: "7.80,7.80-1,latest"
       - uses: docker/build-push-action@v1
@@ -261,7 +261,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/kube-hunter
-          path: ./integrations/kube-hunter/scanner/
+          path: ./scanner/kube-hunter/scanner/
           # Note: not prefixed with a "v" as this matches the aquasec/kube-hunter tags
           tags: "0.3.0,latest"
       - uses: docker/build-push-action@v1
@@ -270,7 +270,7 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           repository: scbexperimental/test-scan
-          path: ./integrations/test-scan/scanner/
+          path: ./scanner/test-scan/scanner/
           # Note: not prefixed with a "v" as this seems to match nmap versioning standards
           tags: "latest"
   integrationTests:
@@ -336,23 +336,23 @@ jobs:
             --set="image.tag=sha-$(git rev-parse --short HEAD)" \
             --set="attribute.name=severity" \
             --set="attribute.value=high"
-          helm -n integration-tests install test-scan ./integrations/test-scan/ --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"
+          helm -n integration-tests install test-scan ./scanner/test-scan/ --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"
           cd tests/integration/
           npx jest --ci --color read-write-hook
           helm -n integration-tests uninstall test-scan update-category update-severity
       - name: "nmap Integration Tests"
         run: |
-          helm -n integration-tests install nmap ./integrations/nmap/ --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"
+          helm -n integration-tests install nmap ./scanner/nmap/ --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"
           cd tests/integration/
           npx jest --ci --color nmap
       - name: "kube-hunter Integration Tests"
         run: |
-          helm -n integration-tests install kube-hunter ./integrations/kube-hunter/ --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"
+          helm -n integration-tests install kube-hunter ./scanner/kube-hunter/ --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"
           cd tests/integration/
           npx jest --ci --color kube-hunter
       - name: "ssh-scan Integration Tests"
         run: |
-          helm -n integration-tests install ssh-scan ./integrations/ssh_scan/ --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"
+          helm -n integration-tests install ssh-scan ./scanner/ssh_scan/ --set="parserImage.tag=sha-$(git rev-parse --short HEAD)"
           # Install dummy-ssh app
           helm -n demo-apps install dummy-ssh ./demo-apps/dummy-ssh/ --wait
           cd tests/integration/

README.md

@@ -20,7 +20,7 @@
 - [Purpose of this Project](#purpose-of-this-project)
 - [Quickstart](#quickstart)
   - [Prerequisites](#prerequisites)
-  - [Deployment](#deployment)
+  - [Deployment (based on Helm)](#deployment-based-on-helm)
   - [Examples](#examples)
   - [Access Services](#access-services)
 - [How does it work?](#how-does-it-work)
@@ -58,14 +58,14 @@ There is a german article about [Security DevOps – Angreifern (immer) einen Sc
 
 - kubernetes (last 4 mayor releases supported: `1.15`, `1.16`, `1.17` & `1.18`)
 
-### Deployment
+### Deployment (based on Helm)
 
 ```bash
-# Deploy secureCodeBox Operator
+# Deploy the secureCodeBox Operator first
 kubectl create namespace securecodebox-system
-helm -n securecodebox-system install securecodebox-operator ./operator/ --set image.tag=hooks
+helm -n securecodebox-system install securecodebox-operator ./operator/
 
-# Deploy definitions for the integrated scanners
+# Deploy SCB scanner Charts for each security scanner you want to use (all optional)
 helm upgrade --install amass ./integrations/amass/
 helm upgrade --install kube-hunter ./integrations/kube-hunter/
 helm upgrade --install nikto ./integrations/nikto
@@ -80,12 +80,12 @@ helm upgrade --install wpscan ./integrations/wpscan/
 helm upgrade --install dummy-ssh ./demo-apps/dummy-ssh/
 
 # Deploy secureCodeBox Hooks 
-helm upgrade --install add-attributes ./hooks/add-attributes/
-helm upgrade --install generic-webhook ./hooks/generic-webhook/
-helm upgrade --install imperative-subsequent-scans ./hooks/imperative-subsequent-scans/
+helm upgrade --install aah ./hooks/add-attributes/
+helm upgrade --install gwh ./hooks/generic-webhook/
+helm upgrade --install issh ./hooks/imperative-subsequent-scans/
 
 ## Persistence Provider: Elasticsearch
-helm upgrade --install persistence-elastic ./hooks/persistence-elastic/
+helm upgrade --install elkh ./hooks/persistence-elastic/
 ```
 
 ### Examples
@@ -116,11 +116,11 @@ kubectl get scans
 
 ### Access Services
 
-* Minio UI
+* Minio UI:
   * AccessKey: `kubectl get secret securecodebox-operator-minio -n securecodebox-system -o=jsonpath='{.data.accesskey}' | base64 --decode; echo`
   * SecretKey: `kubectl get secret securecodebox-operator-minio -n securecodebox-system -o=jsonpath='{.data.secretkey}' | base64 --decode; echo`
   * Port Forward Minio UI: `kubectl port-forward -n securecodebox-system service/securecodebox-operator-minio 9000:9000`
-* Elastic / Kibana UI
+* Elastic / Kibana UI:
  * User: `elastic`
  * Password: `kubectl get secret scb-elasticsearch-es-elastic-user -n scb-analytics -o=jsonpath='{.data.elastic}' | base64 --decode; echo`
  * Port Forward Kibana: `kubectl port-forward -n default service/persistence-elastic-kibana 5601:5601`

hooks/imperative-subsequent-scans/hook.js

@@ -54,7 +54,8 @@ async function handle({
       if (
         cascadeNmapSmb && 
         finding.attributes.port === 445 && 
-        finding.attributes.service === "microsoft-ds"
+        (finding.attributes.service === "microsoft-ds" ||
+         finding.attributes.service === "netbios-ssn")
       ) {
         await startSMBScan({
           parentScan: scan,

hooks/imperative-subsequent-scans/scan-helpers.js

@@ -21,7 +21,7 @@ async function startSubsequentSecureCodeBoxScan({
         ...parentScan.metadata.labels,
       },
       annotations: {
-        "securecodebox.io/hook": "nmap-subsequent-scans",
+        "securecodebox.io/hook": "imperative-subsequent-scans",
         "securecodebox.io/parent-scan": parentScan.metadata.name,
       },
       ownerReferences: [

hooks/imperative-subsequent-scans/values.yaml

@@ -6,15 +6,15 @@ cascade:
   # Cascade nmap scans for each subdomain found by amass
   amassNmap: true
   # Cascade nmap SMB scans for each SMB Port found by nmap
-  nmapSmb: false
+  nmapSmb: true
   # Cascade SSH scans for each SSH Port found by nmap
-  nmapSsh: false
+  nmapSsh: true
   # Cascade SSL scans for each HTTP Port found by nmap
-  nmapSsl: false
+  nmapSsl: true
   # Cascade Nikto scans for each HTTP Port found by nmap
-  nmapNikto: false
+  nmapNikto: true
   # Cascade ZAP scans for each HTTP Port found by nmap
-  nmapZapBaseline: false
+  nmapZapBaseline: true
 
 image:
   registry: docker.io

hooks/persistence-elastic/templates/persistence-provider.yaml

@@ -1,7 +1,7 @@
 apiVersion: "execution.experimental.securecodebox.io/v1"
 kind: ScanCompletionHook
 metadata:
-  name: {{ include "persistence-elastic.fullname" . }}
+  name: {{ .Release.Name }}
   labels:
     type: Structured
 spec:

hooks/persistence-elastic/values.yaml

@@ -5,8 +5,8 @@
 image:
   registry: docker.io
   repository: scbexperimental/persistence-elastic
-  tag: null
-  digest: sha256:25e860d051de0fb7ecb74508d749909d9ec8b5d49cb10466509777bc98e3ec7a
+  tag: hooks
+  digest: null
 
 indexPrefix: "scbv2"
 

operator/Chart.yaml

@@ -6,7 +6,7 @@ type: application
 
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 0.1.0
+version: 0.2.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.