diff --git a/.travis.yml b/.travis.yml index aa27e5fabf..1707eb3092 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,12 @@ language: node_js node_js: - '10' +notifications: + email: + recipients: + - jannik.hollenbach@iteratec.com + on_success: never + on_failure: always services: - docker env: @@ -14,10 +20,10 @@ script: - npm test -- --verbose --forceExit after_failure: - docker ps -a - - docker logs securecodebox_engine_1 - - docker logs securecodebox_scanner-webapplication-zap_1 - - docker logs securecodebox_scanner-webapplication-arachni_1 - - docker logs securecodebox_scanner-infrastructure-amass_1 - - docker logs securecodebox_scanner-infrastructure-nmap_1 - - docker logs securecodebox_scanner-infrastructure-sslyze_1 - - docker logs securecodebox_scanner-webserver-nikto_1 + - docker-compose logs engine + - docker-compose logs scanner-webapplication-zap + - docker-compose logs scanner-webapplication-arachni + - docker-compose logs scanner-infrastructure-amass + - docker-compose logs scanner-infrastructure-nmap + - docker-compose logs scanner-infrastructure-sslyze + - docker-compose logs scanner-webserver-nikto diff --git a/docker-compose.demo.yml b/docker-compose.demo.yml index 4129d1b9b3..d4442b7bec 100644 --- a/docker-compose.demo.yml +++ b/docker-compose.demo.yml @@ -13,7 +13,7 @@ services: networks: - frontend nginx: - image: nginx + image: nginx:1.17-alpine ports: - 8111:80 networks: diff --git a/docs/user-guide/metafields/README.md b/docs/user-guide/metafields/README.md index 284eea47f7..533c4b27e8 100644 --- a/docs/user-guide/metafields/README.md +++ b/docs/user-guide/metafields/README.md @@ -7,6 +7,35 @@ These values can then be used by standerdized components e.g. by the DefectDojo > Note: None of these values are mandatory. + +## Example + +Here's a example of a SecurityTest (see the `PUT +/box/securityTests` endpoint) which Metadata Field set: + +```json +[ + { + "name": "nmap", + "context": "exampleCompoanyNetworkScan", + "tenant": "exampleCompoany", + "metaData": { + "location": "office-gotham-city", + "vlan": "vm-network" + }, + "target": { + "name": "gotham-city-offices", + "location": "192.168.42.0/24", + "attributes": { + "NMAP_PARAMETER": "" + } + } + } +] +``` + +In this example the meta data fields are used to identify the context of the scan more directly than using the string context field. When also using the elasticsearch persistence proivder these fields can be extremly helpfull to easily filter for the sub results you want to have. E.g. only show ports in the `office-gotham-city` or in particular `vlans`. How you end up using the metadata fields is up to you. + ## Standard Values ### Git and Build Values diff --git a/test/.eslintrc b/test/.eslintrc new file mode 100644 index 0000000000..9b17d289f2 --- /dev/null +++ b/test/.eslintrc @@ -0,0 +1,5 @@ +{ + "rules": { + "quotes": ["warn", "single"] + } +} diff --git a/test/arachni.test.js b/test/arachni.test.js index 0774c762fa..a44d24d514 100644 --- a/test/arachni.test.js +++ b/test/arachni.test.js @@ -1,6 +1,6 @@ const { startSecurityTest, Time } = require('./sdk'); -test.skip( +test( 'finds a few findings for a bare nginx container', async () => { const securityTest = await startSecurityTest({ @@ -28,13 +28,7 @@ test.skip( severity: 'LOW', }); - expect(findings).toContainEqual({ - name: 'Interesting response', - category: 'Interesting responses', - severity: 'INFORMATIONAL', - }); - - expect(findings.length).toEqual(2); + expect(findings.length).toEqual(1); }, 5 * Time.Minute ); diff --git a/test/ssh.test.js b/test/ssh.test.js index 830888d18c..4d37191bba 100644 --- a/test/ssh.test.js +++ b/test/ssh.test.js @@ -1,15 +1,15 @@ const { startSecurityTest, Time } = require('./sdk'); test( - 'finds a few low severity findigns for securecodebox.io', + 'finds a few low severity findings for securecodebox.io', async () => { const securityTest = await startSecurityTest({ - context: 'securecodebox.io tls', + context: 'www.iteratec.de ssh', metaData: {}, name: 'ssh', target: { - name: 'securecodebox.io tls', - location: 'securecodebox.io', + name: 'www.iteratec.de ssh', + location: 'www.iteratec.de', attributes: {}, }, }); @@ -28,34 +28,23 @@ test( expect(findings).toContainEqual({ category: 'SSH Service', - description: 'SSH Compliance Information', - name: 'SSH Compliance', + name: 'SSH Service Information', osi_layer: 'NETWORK', severity: 'INFORMATIONAL', }); expect(findings).toContainEqual({ - category: 'SSH Service', - description: ' diffie-hellman-group14-sha1', - name: 'Remove these key exchange algorithms', - osi_layer: 'NETWORK', - severity: 'MEDIUM', - }); - - expect(findings).toContainEqual({ - category: 'SSH Service', - description: - ' umac-64-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, hmac-sha1', - name: 'Remove these MAC algorithms', + category: 'SSH Policy Violation', + description: 'Discouraged SSH authentication methods are used', + name: 'Discouraged SSH authentication methods', osi_layer: 'NETWORK', severity: 'MEDIUM', }); expect( findings - .filter(({ name }) => name !== 'SSH Compliance') - .filter(({ name }) => name !== 'Remove these key exchange algorithms') - .filter(({ name }) => name !== 'Remove these MAC algorithms') + .filter(({ name }) => name !== 'SSH Service Information') + .filter(({ name }) => name !== 'Discouraged SSH authentication methods') ).toEqual([]); }, 2 * Time.Minute diff --git a/test/sslyze.test.js b/test/sslyze.test.js index e3a8abf093..dd3c83ad66 100644 --- a/test/sslyze.test.js +++ b/test/sslyze.test.js @@ -52,16 +52,6 @@ test( category: 'Resumption', severity: 'INFORMATIONAL', }); - expect(findings).toContainEqual({ - name: 'TLSv1 supported', - category: 'TLSv1', - severity: 'LOW', - }); - expect(findings).toContainEqual({ - name: 'TLSv1.1 supported', - category: 'TLSv1.1', - severity: 'INFORMATIONAL', - }); expect(findings).toContainEqual({ name: 'TLSv1.2 supported', category: 'TLSv1.2',