Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit 6d71571

Browse files
rfelberrfelber
committed
Added new readme files for Hooks and introduced more header informations.
1 parent e70be31 commit 6d71571

File tree

16 files changed

+251
-15
lines changed

16 files changed

+251
-15
lines changed

‎README.md‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -85,15 +85,16 @@ helm -n securecodebox-system upgrade --install securecodebox-operator ./operator
8585
Optionally deploy SCB scanner charts for each security scanner you want to use. They should not be installed into the `securecodebox-system` like the operator so that different teams can use different kinds of scanners.
8686

8787
```bash
88-
helm upgrade --install amass ./scanners/amass/
89-
helm upgrade --install kube-hunter ./scanners/kube-hunter/
90-
helm upgrade --install nikto ./scanners/nikto
91-
helm upgrade --install nmap ./scanners/nmap/
92-
helm upgrade --install ssh-scan ./scanners/ssh_scan/
93-
helm upgrade --install sslyze ./scanners/sslyze/
94-
helm upgrade --install trivy ./scanners/trivy/
95-
helm upgrade --install zap ./scanners/zap/
96-
helm upgrade --install wpscan ./scanners/wpscan/
88+
kubectl create namespace scans
89+
helm upgrade --install -n scans amass ./scanners/amass/
90+
helm upgrade --install -n scans kube-hunter ./scanners/kube-hunter/
91+
helm upgrade --install -n scans nikto ./scanners/nikto
92+
helm upgrade --install -n scans nmap ./scanners/nmap/
93+
helm upgrade --install -n scans ssh-scan ./scanners/ssh_scan/
94+
helm upgrade --install -n scans sslyze ./scanners/sslyze/
95+
helm upgrade --install -n scans trivy ./scanners/trivy/
96+
helm upgrade --install -n scans zap ./scanners/zap/
97+
helm upgrade --install -n scans wpscan ./scanners/wpscan/
9798
```
9899

99100
Optional deploy some demo apps for scanning:
@@ -112,6 +113,7 @@ Deploy secureCodeBox Hooks:
112113
helm upgrade --install aah ./hooks/update-field/
113114
helm upgrade --install gwh ./hooks/generic-webhook/
114115
helm upgrade --install issh ./hooks/imperative-subsequent-scans/
116+
helm upgrade --install dssh ./hooks/declarative-subsequent-scans/
115117
```
116118

117119
Persistence provider Elasticsearch:

‎hooks/declarative-subsequent-scans/README.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
---
2+
title: "Cascading Scans"
3+
path: "hooks/declarative-subsequent-scans"
4+
category: "hook"
5+
type: "processing"
6+
state: "released"
7+
usecase: "Enables cascading Scans based declarative _CascadingRules_."
8+
---
9+
10+
<!-- end -->
11+
12+
## Deployment
13+
14+
Installing the Cascading Scans hook will add a ReadOnly Hook to your namespace which looks for matching _CascadingRules_ in the namespace and start the according scans.
15+
16+
```bash
17+
helm upgrade --install dssh ./hooks/declarative-subsequent-scans/
18+
```
19+
20+
### Verification
21+
```bash
22+
$ kubectl get ScanCompletionHooks
23+
NAME TYPE IMAGE
24+
dssh ReadOnly docker.io/scbexperimental/hook-declarative-subsequent-scans:latest
25+
```
26+
27+
## CascadingScan Rules
28+
The CascadingRules are included directly in each helm chart of the individual scanners.
29+
30+
```bash
31+
# Check your CascadingRules
32+
$ kubectl get CascadingRules
33+
NAME STARTS INVASIVENESS INTENSIVENESS
34+
https-tls-scan sslyze non-invasive light
35+
imaps-tls-scan sslyze non-invasive light
36+
nikto-http nikto non-invasive medium
37+
nmap-smb nmap non-invasive light
38+
pop3s-tls-scan sslyze non-invasive light
39+
smtps-tls-scan sslyze non-invasive light
40+
ssh-scan ssh-scan non-invasive light
41+
zap-http zap-baseline non-invasive medium
42+
```
43+
44+
## Starting a cascading Scan
45+
When you start a normal Scan, no CascadingRule will be applied. To use a _CascadingRule_ the scan must be marked to allow cascading rules.
46+
This is implemented using kubernetes label selectors, meaning that scans mark the classes of scans which are allowed to be cascaded by the current one.
47+
48+
### Example
49+
```yaml
50+
cat <<EOF | kubectl apply -f -
51+
apiVersion: "execution.experimental.securecodebox.io/v1"
52+
kind: Scan
53+
metadata:
54+
name: "example.com"
55+
spec:
56+
scanType: nmap
57+
parameters:
58+
- -p22,80,443
59+
- example.com
60+
cascades:
61+
matchLabels:
62+
securecodebox.io/intensive: light
63+
EOF
64+
```
65+
66+
This Scan will used all CascadingRules which are labeled with a "light" intensity.
67+
You can lookup which CascadingRules this selects by running:
68+
69+
```bash
70+
$ kubectl get CascadingRules -l "securecodebox.io/intensive=light"
71+
NAME STARTS INVASIVENESS INTENSIVENESS
72+
https-tls-scan sslyze non-invasive light
73+
imaps-tls-scan sslyze non-invasive light
74+
nmap-smb nmap non-invasive light
75+
pop3s-tls-scan sslyze non-invasive light
76+
smtps-tls-scan sslyze non-invasive light
77+
ssh-scan ssh-scan non-invasive light
78+
```
79+
80+
The label selectors also allow the more powerful matchExpression selectors:
81+
82+
```yaml
83+
cat <<EOF | kubectl apply -f -
84+
apiVersion: "execution.experimental.securecodebox.io/v1"
85+
kind: Scan
86+
metadata:
87+
name: "example.com"
88+
spec:
89+
scanType: nmap
90+
parameters:
91+
- -p22,80,443
92+
- example.com
93+
cascades:
94+
# Using matchExpression instead of matchLabels
95+
matchExpression:
96+
key: "securecodebox.io/intensive"
97+
operator: In
98+
# This select both light and medium intensity rules
99+
values: [light, medium]
100+
EOF
101+
```
102+
103+
This selection can be replicated in kubectl using:
104+
105+
```bash
106+
kubectl get CascadingRules -l "securecodebox.io/intensive in (light,medium)"
107+
NAME STARTS INVASIVENESS INTENSIVENESS
108+
https-tls-scan sslyze non-invasive light
109+
imaps-tls-scan sslyze non-invasive light
110+
nikto-http nikto non-invasive medium
111+
nmap-smb nmap non-invasive light
112+
pop3s-tls-scan sslyze non-invasive light
113+
smtps-tls-scan sslyze non-invasive light
114+
ssh-scan ssh-scan non-invasive light
115+
zap-http zap-baseline non-invasive medium
116+
```

‎hooks/generic-webhook/README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: "Generic WebHook"
3+
path: "hooks/generic-webhook"
4+
category: "hook"
5+
type: "integration"
6+
state: "released"
7+
usecase: "Publishes Scan Findings as WebHook."
8+
---
9+
10+
<!-- end -->
11+
12+
## Deployment
13+
14+
Installing the Generic WebHook hook will add a ReadOnly Hook to your namespace.
15+
16+
```bash
17+
helm upgrade --install gwh ./hooks/generic-webhook/ --set webhookUrl="http://example.com/my/webhook/target"
18+
```

‎hooks/imperative-subsequent-scans/values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@ cascade:
66
# Cascade nmap scans for each subdomain found by amass
77
amassNmap: true
88
# Cascade nmap SMB scans for each SMB Port found by nmap
9-
nmapSmb: true
9+
nmapSmb: false
1010
# Cascade SSH scans for each SSH Port found by nmap
1111
nmapSsh: true
1212
# Cascade SSL scans for each HTTP Port found by nmap
1313
nmapSsl: true
1414
# Cascade Nikto scans for each HTTP Port found by nmap
15-
nmapNikto: true
15+
nmapNikto: false
1616
# Cascade ZAP scans for each HTTP Port found by nmap
17-
nmapZapBaseline: true
17+
nmapZapBaseline: false
1818

1919
image:
2020
registry: docker.io

‎hooks/persistence-elastic/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
title: "Elasticsearch"
3+
path: "hooks/persistence-elastic"
4+
category: "hook"
5+
type: "persistenceProvider"
6+
state: "released"
7+
usecase: "Publishes all Scan Findings to elasticsearch (ECK)."
8+
---
9+
10+
<!-- end -->
11+
12+
## About
13+
The ElasticSearch persistenceProvider hook saves all findings and reports into the configured ElasticSearch index. This allows for some easy searching and visualization of the findings. To learn more about Elasticsearch visit elastic.io.
14+
15+
## Deployment
16+
17+
Installing the Elasticsearch persistenceProvider hook will add a _ReadOnly Hook_ to your namespace.
18+
19+
```bash
20+
helm upgrade --install elkh ./hooks/persistence-elastic/
21+
```
22+
23+
## Configuration
24+
see values.yaml
25+
26+
```yaml
27+
# Define a specific index prefix
28+
indexPrefix: "scbv2"
29+
30+
# Enable this when you already have an Elastic Stack running to which you want to send your results
31+
externalElasticStack:
32+
enabled: false
33+
elasticsearchAddress: "https://elasticsearch.example.com"
34+
kibanaAddress: "https://kibana.example.com"
35+
36+
# Configure authentication schema and credentials the persistence provider should use to connect to elasticsearch
37+
# user and apikey are mutually exclusive, only set one!
38+
authentication:
39+
# Link a pre-existing generic secret with `username` and `password` key / value pairs
40+
userSecret: null
41+
# Link a pre-existing generic secret with `id` and `key` key / value pairs
42+
apiKeySecret: null
43+
44+
# Configures included Elasticsearch subchart
45+
elasticsearch:
46+
enabled: true
47+
replicas: 1
48+
minimumMasterNodes: 1
49+
# image: docker.elastic.co/elasticsearch/elasticsearch-oss
50+
51+
# Configures included Elasticsearch subchart
52+
kibana:
53+
enabled: true
54+
# image: docker.elastic.co/kibana/kibana-oss
55+
```

‎hooks/persistence-elastic/values.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ image:
88
tag: latest
99
digest: null
1010

11+
# Define a specific index prefix
1112
indexPrefix: "scbv2"
1213

1314
# Enable this when you already have an Elastic Stack running to which you want to send your results

‎hooks/update-field/README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: "Generic WebHook"
3+
path: "hooks/generic-webhook"
4+
category: "hook"
5+
type: "integration"
6+
state: "released"
7+
usecase: "Publishes Scan Findings as WebHook."
8+
---
9+
10+
<!-- end -->
11+
12+
## Deployment
13+
14+
Installing the _Update Field_ hook will add a ReadOnly Hook to your namespace.
15+
16+
```bash
17+
helm upgrade --install gwh ./hooks/generic-webhook/ --set webhookUrl="http://example.com/my/webhook/target"
18+
```

‎scanners/amass/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
title: "Amass"
33
path: "scanners/amass"
44
category: "scanner"
5+
type: "Network"
6+
state: "released"
7+
appVersion: 3.7.2
58
usecase: "Subdomain Enumeration Scanner"
69
---
710

‎scanners/kube-hunter/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
title: "kube-hunter"
33
path: "scanners/kube-hunter"
44
category: "scanner"
5+
type: "Kubernetes"
6+
state: "released"
7+
appVersion: 0.3.1
58
usecase: "Kubernetes Vulnerability Scanner"
69
---
710

‎scanners/nikto/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
title: "Nikto"
33
path: "scanners/nikto"
44
category: "scanner"
5+
type: "Webserver"
6+
state: "released"
7+
appVersion: 2.1.6
58
usecase: "Webserver Vulnerability Scanner"
69
---
710

0 commit comments

Comments
 (0)