Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 2af22a9

Browse files
nigthknightnigthknight
committed
Merge branch 'master' into refactoring-examples
2 parents 2a6210a + a8f6eeb commit 2af22a9

File tree

55 files changed

+1819
-1641
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+1819
-1641
lines changed

‎.github/workflows/helm-charts.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
on:
2+
release:
3+
types: [published]
4+
name: "Publish Helm Charts"
5+
jobs:
6+
helm:
7+
name: Package and Publish
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/checkout@v2
11+
- name: "Install yq"
12+
run: |
13+
sudo snap install yq
14+
- name: Parse Tag
15+
run: echo ::set-env name=RELEASE_VERSION::${GITHUB_REF#refs/*/}
16+
- name: "Publish Helm Chart"
17+
env:
18+
HELM_REGISTRY: https://charts.securecodebox.io
19+
USERNAME: ${{ secrets.HELM_REGISTRY_USERNAME }}
20+
PASSWORD: ${{ secrets.HELM_REGISTRY_PASSWORD }}
21+
run: |
22+
# Publish charts in all folders containing a `Chart.yaml` file
23+
# https://github.com/koalaman/shellcheck/wiki/SC2044
24+
find . -type f -name Chart.yaml -print0 | while IFS= read -r -d '' chart; do
25+
(
26+
dir="$(dirname "${chart}")"
27+
cd "${dir}" || exit
28+
echo "Processing Chart in $dir"
29+
helm lint .
30+
helm package --version $RELEASE_VERSION .
31+
NAME=$(yq read - name < Chart.yaml)
32+
curl --silent --show-error --user "${USERNAME}:${PASSWORD}" --data-binary "@${NAME}-${RELEASE_VERSION}.tgz" "${HELM_REGISTRY}/api/charts"
33+
)
34+
done

‎README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
- [Local Scan Examples](#local-scan-examples)
3636
- [Public Scan Examples](#public-scan-examples)
3737
- [Then get the current State of the Scan by running:](#then-get-the-current-state-of-the-scan-by-running)
38+
- [To delete a scan, use ```kubectl delete```, e.g. for localhost nmap scan:](#to-delete-a-scan-use-kubectl-delete-eg-for-localhost-nmap-scan)
3839
- [Access Services](#access-services)
3940
- [How does it work?](#how-does-it-work)
4041
- [Architecture](#architecture)
@@ -109,9 +110,10 @@ helm upgrade --install swagger-petstore ./demo-apps/swagger-petstore/
109110
Deploy secureCodeBox Hooks:
110111

111112
```bash
112-
helm upgrade --install aah ./hooks/update-field/
113+
helm upgrade --install ufh ./hooks/update-field/
113114
helm upgrade --install gwh ./hooks/generic-webhook/
114115
helm upgrade --install issh ./hooks/imperative-subsequent-scans/
116+
helm upgrade --install dssh ./hooks/declarative-subsequent-scans/
115117
```
116118

117119
Persistence provider Elasticsearch:

‎demo-apps/bodgeit/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
version: 0.1.0
33
type: application
4-
appVersion: "latest"
4+
appVersion: "v1.4.0"
55
name: bodgeit
66
description: "The BodgeIt Store is a vulnerable web app which is aimed at people who are new to pen testing"
77
home: https://github.com/psiinon/bodgeit

‎demo-apps/juice-shop/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v2
22
version: 0.1.0
3-
appVersion: "v10.0.0"
3+
appVersion: "v11.1.2"
44
name: juice-shop
55
description: "OWASP Juice Shop: Probably the most modern and sophisticated insecure web application"
66
type: application

‎hooks/declarative-subsequent-scans/README.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
---
2+
title: "Cascading Scans"
3+
path: "hooks/declarative-subsequent-scans"
4+
category: "hook"
5+
type: "processing"
6+
state: "released"
7+
usecase: "Cascading Scans based declarative Rules."
8+
---
9+
10+
<!-- end -->
11+
12+
## Deployment
13+
14+
Installing the Cascading Scans hook will add a ReadOnly Hook to your namespace which looks for matching _CascadingRules_ in the namespace and start the according scans.
15+
16+
```bash
17+
helm upgrade --install dssh ./hooks/declarative-subsequent-scans/
18+
```
19+
20+
### Verification
21+
```bash
22+
kubectl get ScanCompletionHooks
23+
NAME TYPE IMAGE
24+
dssh ReadOnly docker.io/scbexperimental/hook-declarative-subsequent-scans:latest
25+
```
26+
27+
## CascadingScan Rules
28+
The CascadingRules are included directly in each helm chart of the individual scanners.
29+
30+
```bash
31+
# Check your CascadingRules
32+
kubectl get CascadingRules
33+
NAME STARTS INVASIVENESS INTENSIVENESS
34+
https-tls-scan sslyze non-invasive light
35+
imaps-tls-scan sslyze non-invasive light
36+
nikto-http nikto non-invasive medium
37+
nmap-smb nmap non-invasive light
38+
pop3s-tls-scan sslyze non-invasive light
39+
smtps-tls-scan sslyze non-invasive light
40+
ssh-scan ssh-scan non-invasive light
41+
zap-http zap-baseline non-invasive medium
42+
```
43+
44+
## Starting a cascading Scan
45+
When you start a normal Scan, no CascadingRule will be applied. To use a _CascadingRule_ the scan must be marked to allow cascading rules.
46+
This is implemented using kubernetes label selectors, meaning that scans mark the classes of scans which are allowed to be cascaded by the current one.
47+
48+
### Example
49+
```yaml
50+
cat <<EOF | kubectl apply -f -
51+
apiVersion: "execution.experimental.securecodebox.io/v1"
52+
kind: Scan
53+
metadata:
54+
name: "example.com"
55+
spec:
56+
scanType: nmap
57+
parameters:
58+
- -p22,80,443
59+
- example.com
60+
cascades:
61+
matchLabels:
62+
securecodebox.io/intensive: light
63+
EOF
64+
```
65+
66+
This Scan will used all CascadingRules which are labeled with a "light" intensity.
67+
You can lookup which CascadingRules this selects by running:
68+
69+
```bash
70+
kubectl get CascadingRules -l "securecodebox.io/intensive=light"
71+
NAME STARTS INVASIVENESS INTENSIVENESS
72+
https-tls-scan sslyze non-invasive light
73+
imaps-tls-scan sslyze non-invasive light
74+
nmap-smb nmap non-invasive light
75+
pop3s-tls-scan sslyze non-invasive light
76+
smtps-tls-scan sslyze non-invasive light
77+
ssh-scan ssh-scan non-invasive light
78+
```
79+
80+
The label selectors also allow the more powerful matchExpression selectors:
81+
82+
```yaml
83+
cat <<EOF | kubectl apply -f -
84+
apiVersion: "execution.experimental.securecodebox.io/v1"
85+
kind: Scan
86+
metadata:
87+
name: "example.com"
88+
spec:
89+
scanType: nmap
90+
parameters:
91+
- -p22,80,443
92+
- example.com
93+
cascades:
94+
# Using matchExpression instead of matchLabels
95+
matchExpression:
96+
key: "securecodebox.io/intensive"
97+
operator: In
98+
# This select both light and medium intensity rules
99+
values: [light, medium]
100+
EOF
101+
```
102+
103+
This selection can be replicated in kubectl using:
104+
105+
```bash
106+
kubectl get CascadingRules -l "securecodebox.io/intensive in (light,medium)"
107+
NAME STARTS INVASIVENESS INTENSIVENESS
108+
https-tls-scan sslyze non-invasive light
109+
imaps-tls-scan sslyze non-invasive light
110+
nikto-http nikto non-invasive medium
111+
nmap-smb nmap non-invasive light
112+
pop3s-tls-scan sslyze non-invasive light
113+
smtps-tls-scan sslyze non-invasive light
114+
ssh-scan ssh-scan non-invasive light
115+
zap-http zap-baseline non-invasive medium
116+
```

‎hooks/generic-webhook/README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: "Generic WebHook"
3+
path: "hooks/generic-webhook"
4+
category: "hook"
5+
type: "integration"
6+
state: "released"
7+
usecase: "Publishes Scan Findings as WebHook."
8+
---
9+
10+
<!-- end -->
11+
12+
## Deployment
13+
14+
Installing the Generic WebHook hook will add a ReadOnly Hook to your namespace.
15+
16+
```bash
17+
helm upgrade --install gwh ./hooks/generic-webhook/ --set webhookUrl="http://example.com/my/webhook/target"
18+
```

‎hooks/imperative-subsequent-scans/values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@ cascade:
66
# Cascade nmap scans for each subdomain found by amass
77
amassNmap: true
88
# Cascade nmap SMB scans for each SMB Port found by nmap
9-
nmapSmb: true
9+
nmapSmb: false
1010
# Cascade SSH scans for each SSH Port found by nmap
1111
nmapSsh: true
1212
# Cascade SSL scans for each HTTP Port found by nmap
1313
nmapSsl: true
1414
# Cascade Nikto scans for each HTTP Port found by nmap
15-
nmapNikto: true
15+
nmapNikto: false
1616
# Cascade ZAP scans for each HTTP Port found by nmap
17-
nmapZapBaseline: true
17+
nmapZapBaseline: false
1818

1919
image:
2020
registry: docker.io

‎hooks/persistence-defectdojo/README.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
title: "DefectDojo"
3+
path: "hooks/persistence-defectdojo"
4+
category: "hook"
5+
type: "persistenceProvider"
6+
state: "roadmap"
7+
usecase: "Publishes all Scan Findings to DefectDojo."
8+
---
9+
10+
<!-- end -->
11+
12+
## About
13+
14+
DefectDojo is an open-source tool for importing and managing findings of security scanners. The DefectDojo persistence provider can be used to create new Engagements for SecurityTests run via the secureCodeBox and import all findings which were identified automatically to DefectDojo.
15+
16+
Tools which are supported both by the secureCodeBox and DefectDojo (OWASP ZAP & Nmap) this is done by importing the raw scan report into DefectDojo. Findings by other secureCodeBox supported scanners are currently not directly supported by DefectDojo. These findings are imported via a generic finding API of DefectDojo, which might cause some loss of information on the findings.
17+
18+
To learn more about DefectDojo visit [DefectDojo GitHub] or [DefectDojo Website].
19+
20+
## Deployment
21+
The secureCodeBox core team is working on an integration of DefectDojo. We will keep you informed.
22+
23+
24+
[DefectDojo Website]: https://www.defectdojo.org/
25+
[DefectDojo GitHub]: https://github.com/DefectDojo/django-DefectDojo
26+
[DefectDojo Documentation]: https://defectdojo.readthedocs.io/en/latest/

‎hooks/persistence-elastic/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
title: "Elasticsearch"
3+
path: "hooks/persistence-elastic"
4+
category: "hook"
5+
type: "persistenceProvider"
6+
state: "released"
7+
usecase: "Publishes all Scan Findings to Elasticsearch."
8+
---
9+
10+
<!-- end -->
11+
12+
## About
13+
The ElasticSearch persistenceProvider hook saves all findings and reports into the configured ElasticSearch index. This allows for some easy searching and visualization of the findings. To learn more about Elasticsearch visit elastic.io.
14+
15+
## Deployment
16+
17+
Installing the Elasticsearch persistenceProvider hook will add a _ReadOnly Hook_ to your namespace.
18+
19+
```bash
20+
helm upgrade --install elkh ./hooks/persistence-elastic/
21+
```
22+
23+
## Configuration
24+
see values.yaml
25+
26+
```yaml
27+
# Define a specific index prefix
28+
indexPrefix: "scbv2"
29+
30+
# Enable this when you already have an Elastic Stack running to which you want to send your results
31+
externalElasticStack:
32+
enabled: false
33+
elasticsearchAddress: "https://elasticsearch.example.com"
34+
kibanaAddress: "https://kibana.example.com"
35+
36+
# Configure authentication schema and credentials the persistence provider should use to connect to elasticsearch
37+
# user and apikey are mutually exclusive, only set one!
38+
authentication:
39+
# Link a pre-existing generic secret with `username` and `password` key / value pairs
40+
userSecret: null
41+
# Link a pre-existing generic secret with `id` and `key` key / value pairs
42+
apiKeySecret: null
43+
44+
# Configures included Elasticsearch subchart
45+
elasticsearch:
46+
enabled: true
47+
replicas: 1
48+
minimumMasterNodes: 1
49+
# image: docker.elastic.co/elasticsearch/elasticsearch-oss
50+
51+
# Configures included Elasticsearch subchart
52+
kibana:
53+
enabled: true
54+
# image: docker.elastic.co/kibana/kibana-oss
55+
```

‎hooks/persistence-elastic/values.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ image:
88
tag: latest
99
digest: null
1010

11+
# Define a specific index prefix
1112
indexPrefix: "scbv2"
1213

1314
# Enable this when you already have an Elastic Stack running to which you want to send your results

0 commit comments

Comments
 (0)