Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit ef60a37

Browse files
J12934J12934
authored
Merge pull request #59 from secureCodeBox/feature/nikto-examples
Add Example Nikto Scans
2 parents 6a2fcf3 + 4cb726d commit ef60a37

File tree

9 files changed

+2700
-0
lines changed

9 files changed

+2700
-0
lines changed

‎bin/install-all.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,11 @@ helm upgrade --install zap ./scanners/zap/
1616
helm upgrade --install wpscan ./scanners/wpscan/
1717

1818
helm upgrade --install dummy-ssh ./demo-apps/dummy-ssh/
19+
helm upgrade --install juice-shop ./demo-apps/juice-shop/
20+
helm upgrade --install old-wordpress ./demo-apps/old-wordpress/
21+
helm upgrade --install bodgeit ./demo-apps/bodgeit/
22+
helm upgrade --install swagger-petstore ./demo-apps/swagger-petstore/
23+
helm upgrade --install http-webhook ./demo-apps/http-webhook/
1924

2025
helm upgrade --install aah ./hooks/update-field/
2126
helm upgrade --install gwh ./hooks/generic-webhook/

‎bin/uninstall-all.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,11 @@ helm uninstall zap
1515
helm uninstall wpscan
1616

1717
helm uninstall dummy-ssh
18+
helm uninstall bodgeit
19+
helm uninstall http-webhook
20+
helm uninstall juice-shop
21+
helm uninstall old-wordpress
22+
helm uninstall swagger-petstore
1823

1924
helm uninstall aah
2025
helm uninstall gwh

‎scanners/nikto/examples/demo-bodgeit/findings.yaml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
[
2+
{
3+
"name": "The anti-clickjacking X-Frame-Options header is not present.",
4+
"description": null,
5+
"category": "X-Frame-Options Header",
6+
"location": "http://bodgeit/",
7+
"osi_layer": "NETWORK",
8+
"severity": "LOW",
9+
"attributes": {
10+
"ip_address": "10.105.36.237",
11+
"hostname": "bodgeit",
12+
"banner": "Apache-Coyote/1.1",
13+
"method": "GET",
14+
"port": 8080,
15+
"niktoId": 999957
16+
},
17+
"id": "9fc0b231-3a91-4976-ad59-35d59a585a38"
18+
},
19+
{
20+
"name": "The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS",
21+
"description": null,
22+
"category": "X-XSS-Protection",
23+
"location": "http://bodgeit/",
24+
"osi_layer": "NETWORK",
25+
"severity": "LOW",
26+
"attributes": {
27+
"ip_address": "10.105.36.237",
28+
"hostname": "bodgeit",
29+
"banner": "Apache-Coyote/1.1",
30+
"method": "GET",
31+
"port": 8080,
32+
"niktoId": 999102
33+
},
34+
"id": "fd763ddc-beaf-4bb0-91f6-334fadfaad03"
35+
},
36+
{
37+
"name": "The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type",
38+
"description": null,
39+
"category": "X-Content-Type-Options Header",
40+
"location": "http://bodgeit/",
41+
"osi_layer": "NETWORK",
42+
"severity": "INFORMATIONAL",
43+
"attributes": {
44+
"ip_address": "10.105.36.237",
45+
"hostname": "bodgeit",
46+
"banner": "Apache-Coyote/1.1",
47+
"method": "GET",
48+
"port": 8080,
49+
"niktoId": 999103
50+
},
51+
"id": "08fc1392-6da9-4d57-beb2-dc7f72bea503"
52+
},
53+
{
54+
"name": "/favicon.ico file identifies this app/server as: Apache Tomcat (possibly 5.5.26 through 8.0.15), Alfresco Community",
55+
"description": null,
56+
"category": "Identified Software",
57+
"location": "http://bodgeit/favicon.ico",
58+
"osi_layer": "NETWORK",
59+
"severity": "INFORMATIONAL",
60+
"attributes": {
61+
"ip_address": "10.105.36.237",
62+
"hostname": "bodgeit",
63+
"banner": "Apache-Coyote/1.1",
64+
"method": "GET",
65+
"port": 8080,
66+
"niktoId": 500645
67+
},
68+
"id": "4a6b694c-b0ac-465e-929e-8e67cbded3a8"
69+
},
70+
{
71+
"name": "Allowed HTTP Methods: GET, HEAD, POST, PUT, DELETE, OPTIONS",
72+
"description": null,
73+
"category": "Nikto Finding",
74+
"location": "http://bodgeit/",
75+
"osi_layer": "NETWORK",
76+
"severity": "INFORMATIONAL",
77+
"attributes": {
78+
"ip_address": "10.105.36.237",
79+
"hostname": "bodgeit",
80+
"banner": "Apache-Coyote/1.1",
81+
"method": "OPTIONS",
82+
"port": 8080,
83+
"niktoId": 999990
84+
},
85+
"id": "7fe0661b-1eac-4e7c-ad02-0fa5b293700c"
86+
},
87+
{
88+
"name": "HTTP method ('Allow' Header): 'PUT' method could allow clients to save files on the web server.",
89+
"description": null,
90+
"category": "Nikto Finding",
91+
"location": "http://bodgeit/",
92+
"osi_layer": "NETWORK",
93+
"severity": "INFORMATIONAL",
94+
"attributes": {
95+
"ip_address": "10.105.36.237",
96+
"hostname": "bodgeit",
97+
"banner": "Apache-Coyote/1.1",
98+
"method": "GET",
99+
"port": 8080,
100+
"niktoId": 400001
101+
},
102+
"id": "f63b2cd6-cb19-43f5-a086-c5084e8b8e2b"
103+
},
104+
{
105+
"name": "HTTP method ('Allow' Header): 'DELETE' may allow clients to remove files on the web server.",
106+
"description": null,
107+
"category": "Nikto Finding",
108+
"location": "http://bodgeit/",
109+
"osi_layer": "NETWORK",
110+
"severity": "INFORMATIONAL",
111+
"attributes": {
112+
"ip_address": "10.105.36.237",
113+
"hostname": "bodgeit",
114+
"banner": "Apache-Coyote/1.1",
115+
"method": "GET",
116+
"port": 8080,
117+
"niktoId": 400000
118+
},
119+
"id": "237ff776-7fc1-4509-b51e-d916b3951422"
120+
}
121+
]

‎scanners/nikto/examples/demo-bodgeit/nikto-results.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"host": "bodgeit",
3+
"ip": "10.105.36.237",
4+
"port": "8080",
5+
"banner": "Apache-Coyote/1.1",
6+
"vulnerabilities": [
7+
{
8+
"id": "999957",
9+
"OSVDB": "0",
10+
"method": "GET",
11+
"url": "/",
12+
"msg": "The anti-clickjacking X-Frame-Options header is not present."
13+
},
14+
{
15+
"id": "999102",
16+
"OSVDB": "0",
17+
"method": "GET",
18+
"url": "/",
19+
"msg": "The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS"
20+
},
21+
{
22+
"id": "999103",
23+
"OSVDB": "0",
24+
"method": "GET",
25+
"url": "/",
26+
"msg": "The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type"
27+
},
28+
{
29+
"id": "500645",
30+
"OSVDB": "39272",
31+
"method": "GET",
32+
"url": "/favicon.ico",
33+
"msg": "/favicon.ico file identifies this app/server as: Apache Tomcat (possibly 5.5.26 through 8.0.15), Alfresco Community"
34+
},
35+
{
36+
"id": "999990",
37+
"OSVDB": "0",
38+
"method": "OPTIONS",
39+
"url": "/",
40+
"msg": "Allowed HTTP Methods: GET, HEAD, POST, PUT, DELETE, OPTIONS "
41+
},
42+
{
43+
"id": "400001",
44+
"OSVDB": "397",
45+
"method": "GET",
46+
"url": "/",
47+
"msg": "HTTP method ('Allow' Header): 'PUT' method could allow clients to save files on the web server."
48+
},
49+
{
50+
"id": "400000",
51+
"OSVDB": "5646",
52+
"method": "GET",
53+
"url": "/",
54+
"msg": "HTTP method ('Allow' Header): 'DELETE' may allow clients to remove files on the web server."
55+
}
56+
]
57+
}

‎scanners/nikto/examples/demo-bodgeit/scan.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: 'execution.experimental.securecodebox.io/v1'
2+
kind: Scan
3+
metadata:
4+
name: 'nikto-bodgeit'
5+
labels:
6+
organization: 'secureCodeBox'
7+
spec:
8+
scanType: 'nikto'
9+
parameters:
10+
- '-h'
11+
- 'bodgeit'
12+
- '-port 8080'
13+
- '-Tuning'
14+
# Only enable fast (ish) Scan Options, remove attack option like SQLi and RCE. We will leave those to ZAP
15+
- '1,2,3,5,7,b'

0 commit comments

Comments
 (0)