From 45eb2b707bdd051b17a6ffe20ed8b37df4e41810 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 17 Sep 2019 16:55:54 +0200 Subject: [PATCH 01/13] Re-enable arachni integration test --- test/arachni.test.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/arachni.test.js b/test/arachni.test.js index 0774c762fa..ee65b9cbb3 100644 --- a/test/arachni.test.js +++ b/test/arachni.test.js @@ -1,6 +1,6 @@ const { startSecurityTest, Time } = require('./sdk'); -test.skip( +test( 'finds a few findings for a bare nginx container', async () => { const securityTest = await startSecurityTest({ From 5b1c37962a607fee32e6b4a471c6ed64cffc12a1 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 18 Sep 2019 10:55:57 +0200 Subject: [PATCH 02/13] Retrigger build for amass fix From e3dd60ac23eef27421c4a86bd315d2e097a00340 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 9 Oct 2019 16:32:12 +0200 Subject: [PATCH 03/13] Fix nginx version --- docker-compose.demo.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.demo.yml b/docker-compose.demo.yml index 4129d1b9b3..d4442b7bec 100644 --- a/docker-compose.demo.yml +++ b/docker-compose.demo.yml @@ -13,7 +13,7 @@ services: networks: - frontend nginx: - image: nginx + image: nginx:1.17-alpine ports: - 8111:80 networks: From bac3404f44a566515c547b63edd7b5e345ad558c Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 9 Oct 2019 16:32:55 +0200 Subject: [PATCH 04/13] Use docker compose to show logs instead of using docker directly Apperently there now is a kinda unpredictable hash behind the name and number of the container so that you cant use docker directly anymore. --- .travis.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.travis.yml b/.travis.yml index aa27e5fabf..79a7ec583a 100644 --- a/.travis.yml +++ b/.travis.yml @@ -14,10 +14,10 @@ script: - npm test -- --verbose --forceExit after_failure: - docker ps -a - - docker logs securecodebox_engine_1 - - docker logs securecodebox_scanner-webapplication-zap_1 - - docker logs securecodebox_scanner-webapplication-arachni_1 - - docker logs securecodebox_scanner-infrastructure-amass_1 - - docker logs securecodebox_scanner-infrastructure-nmap_1 - - docker logs securecodebox_scanner-infrastructure-sslyze_1 - - docker logs securecodebox_scanner-webserver-nikto_1 + - docker-compose logs securecodebox_engine + - docker-compose logs securecodebox_scanner-webapplication-zap + - docker-compose logs securecodebox_scanner-webapplication-arachni + - docker-compose logs securecodebox_scanner-infrastructure-amass + - docker-compose logs securecodebox_scanner-infrastructure-nmap + - docker-compose logs securecodebox_scanner-infrastructure-sslyze + - docker-compose logs securecodebox_scanner-webserver-nikto From 1794ea10160c96f02d491cc805867ef3252be2ad Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Wed, 9 Oct 2019 16:47:56 +0200 Subject: [PATCH 05/13] Corrected docker-compose service name in log commands --- .travis.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.travis.yml b/.travis.yml index 79a7ec583a..10107458c4 100644 --- a/.travis.yml +++ b/.travis.yml @@ -14,10 +14,10 @@ script: - npm test -- --verbose --forceExit after_failure: - docker ps -a - - docker-compose logs securecodebox_engine - - docker-compose logs securecodebox_scanner-webapplication-zap - - docker-compose logs securecodebox_scanner-webapplication-arachni - - docker-compose logs securecodebox_scanner-infrastructure-amass - - docker-compose logs securecodebox_scanner-infrastructure-nmap - - docker-compose logs securecodebox_scanner-infrastructure-sslyze - - docker-compose logs securecodebox_scanner-webserver-nikto + - docker-compose logs engine + - docker-compose logs scanner-webapplication-zap + - docker-compose logs scanner-webapplication-arachni + - docker-compose logs scanner-infrastructure-amass + - docker-compose logs scanner-infrastructure-nmap + - docker-compose logs scanner-infrastructure-sslyze + - docker-compose logs scanner-webserver-nikto From 1e781c01a0401f6cc22af7212c1a806902b56e7c Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 14 Oct 2019 11:10:57 +0200 Subject: [PATCH 06/13] Remove "Interesting Response" from expected arachni findings --- test/arachni.test.js | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/test/arachni.test.js b/test/arachni.test.js index ee65b9cbb3..a44d24d514 100644 --- a/test/arachni.test.js +++ b/test/arachni.test.js @@ -28,13 +28,7 @@ test( severity: 'LOW', }); - expect(findings).toContainEqual({ - name: 'Interesting response', - category: 'Interesting responses', - severity: 'INFORMATIONAL', - }); - - expect(findings.length).toEqual(2); + expect(findings.length).toEqual(1); }, 5 * Time.Minute ); From 978f41e4bf04bb85e5119689021ba13938e738af Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 21 Oct 2019 11:47:49 +0200 Subject: [PATCH 07/13] Update expected ssh scanner findings for SCB SSH Findings 1.1.0 --- test/ssh.test.js | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/test/ssh.test.js b/test/ssh.test.js index 830888d18c..d8807c37db 100644 --- a/test/ssh.test.js +++ b/test/ssh.test.js @@ -28,34 +28,33 @@ test( expect(findings).toContainEqual({ category: 'SSH Service', - description: 'SSH Compliance Information', - name: 'SSH Compliance', + description: undefined, + name: 'SSH Service Information', osi_layer: 'NETWORK', severity: 'INFORMATIONAL', }); expect(findings).toContainEqual({ - category: 'SSH Service', - description: ' diffie-hellman-group14-sha1', - name: 'Remove these key exchange algorithms', + category: 'SSH Policy Violation', + description: 'Deprecated / discouraged SSH key algorithms are used', + name: 'Insecure SSH Key Algorithms', osi_layer: 'NETWORK', severity: 'MEDIUM', }); expect(findings).toContainEqual({ - category: 'SSH Service', - description: - ' umac-64-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, hmac-sha1', - name: 'Remove these MAC algorithms', + category: 'SSH Policy Violation', + description: 'Deprecated / discouraged SSH MAC algorithms are used', + name: 'Insecure SSH MAC Algorithms', osi_layer: 'NETWORK', severity: 'MEDIUM', }); expect( findings - .filter(({ name }) => name !== 'SSH Compliance') - .filter(({ name }) => name !== 'Remove these key exchange algorithms') - .filter(({ name }) => name !== 'Remove these MAC algorithms') + .filter(({ name }) => name !== 'SSH Service Information') + .filter(({ name }) => name !== 'Insecure SSH Key Algorithms') + .filter(({ name }) => name !== 'Insecure SSH MAC Algorithms') ).toEqual([]); }, 2 * Time.Minute From c501444c0463d13dba4468e167fca13d1e3ad931 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 21 Oct 2019 13:24:57 +0200 Subject: [PATCH 08/13] Configure mail notifications manually --- .travis.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.travis.yml b/.travis.yml index 10107458c4..1707eb3092 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,12 @@ language: node_js node_js: - '10' +notifications: + email: + recipients: + - jannik.hollenbach@iteratec.com + on_success: never + on_failure: always services: - docker env: From eeb6c22c6c3a37c0c003562dd1285feb49ead71a Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Mon, 21 Oct 2019 16:37:43 +0200 Subject: [PATCH 09/13] Add a concrete example of how metadata fields can be used --- docs/user-guide/metafields/README.md | 29 ++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/docs/user-guide/metafields/README.md b/docs/user-guide/metafields/README.md index 284eea47f7..533c4b27e8 100644 --- a/docs/user-guide/metafields/README.md +++ b/docs/user-guide/metafields/README.md @@ -7,6 +7,35 @@ These values can then be used by standerdized components e.g. by the DefectDojo > Note: None of these values are mandatory. + +## Example + +Here's a example of a SecurityTest (see the `PUT +/box/securityTests` endpoint) which Metadata Field set: + +```json +[ + { + "name": "nmap", + "context": "exampleCompoanyNetworkScan", + "tenant": "exampleCompoany", + "metaData": { + "location": "office-gotham-city", + "vlan": "vm-network" + }, + "target": { + "name": "gotham-city-offices", + "location": "192.168.42.0/24", + "attributes": { + "NMAP_PARAMETER": "" + } + } + } +] +``` + +In this example the meta data fields are used to identify the context of the scan more directly than using the string context field. When also using the elasticsearch persistence proivder these fields can be extremly helpfull to easily filter for the sub results you want to have. E.g. only show ports in the `office-gotham-city` or in particular `vlans`. How you end up using the metadata fields is up to you. + ## Standard Values ### Git and Build Values From 8637b223a77fdee3993d79361dafeed403c210ef Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 19 Nov 2019 12:50:17 +0100 Subject: [PATCH 10/13] Move SSH Scan Test Target to www.iteratec.de securecodebox.io doesn't have a ssh port open anymore since we moved over to github pages ;) --- test/ssh.test.js | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) diff --git a/test/ssh.test.js b/test/ssh.test.js index d8807c37db..bba41f7870 100644 --- a/test/ssh.test.js +++ b/test/ssh.test.js @@ -1,15 +1,15 @@ const { startSecurityTest, Time } = require('./sdk'); test( - 'finds a few low severity findigns for securecodebox.io', + 'finds a few low severity findings for securecodebox.io', async () => { const securityTest = await startSecurityTest({ - context: 'securecodebox.io tls', + context: 'www.iteratec.de ssh', metaData: {}, name: 'ssh', target: { - name: 'securecodebox.io tls', - location: 'securecodebox.io', + name: 'www.iteratec.de ssh', + location: 'www.iteratec.de', attributes: {}, }, }); @@ -36,16 +36,8 @@ test( expect(findings).toContainEqual({ category: 'SSH Policy Violation', - description: 'Deprecated / discouraged SSH key algorithms are used', - name: 'Insecure SSH Key Algorithms', - osi_layer: 'NETWORK', - severity: 'MEDIUM', - }); - - expect(findings).toContainEqual({ - category: 'SSH Policy Violation', - description: 'Deprecated / discouraged SSH MAC algorithms are used', - name: 'Insecure SSH MAC Algorithms', + description: 'Discouraged SSH authentication methods are used', + name: 'Discouraged SSH authentication methods', osi_layer: 'NETWORK', severity: 'MEDIUM', }); @@ -53,8 +45,7 @@ test( expect( findings .filter(({ name }) => name !== 'SSH Service Information') - .filter(({ name }) => name !== 'Insecure SSH Key Algorithms') - .filter(({ name }) => name !== 'Insecure SSH MAC Algorithms') + .filter(({ name }) => name !== 'Discouraged SSH authentication methods') ).toEqual([]); }, 2 * Time.Minute From be70a4ee06717cd57740547937524666b5bd5b0e Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 19 Nov 2019 13:44:38 +0100 Subject: [PATCH 11/13] Adjust sslyze findings to the new website --- test/sslyze.test.js | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/test/sslyze.test.js b/test/sslyze.test.js index e3a8abf093..dd3c83ad66 100644 --- a/test/sslyze.test.js +++ b/test/sslyze.test.js @@ -52,16 +52,6 @@ test( category: 'Resumption', severity: 'INFORMATIONAL', }); - expect(findings).toContainEqual({ - name: 'TLSv1 supported', - category: 'TLSv1', - severity: 'LOW', - }); - expect(findings).toContainEqual({ - name: 'TLSv1.1 supported', - category: 'TLSv1.1', - severity: 'INFORMATIONAL', - }); expect(findings).toContainEqual({ name: 'TLSv1.2 supported', category: 'TLSv1.2', From 322224e856298fb94be17d1028ce810ac942477f Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 19 Nov 2019 14:19:54 +0100 Subject: [PATCH 12/13] Configure eslint to match existing style --- test/.eslintrc | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 test/.eslintrc diff --git a/test/.eslintrc b/test/.eslintrc new file mode 100644 index 0000000000..9b17d289f2 --- /dev/null +++ b/test/.eslintrc @@ -0,0 +1,5 @@ +{ + "rules": { + "quotes": ["warn", "single"] + } +} From e164c95bb541a592f9f028ee538d8e600b8b7096 Mon Sep 17 00:00:00 2001 From: Jannik Hollenbach Date: Tue, 19 Nov 2019 14:20:57 +0100 Subject: [PATCH 13/13] Remove unexpected undefined --- test/ssh.test.js | 1 - 1 file changed, 1 deletion(-) diff --git a/test/ssh.test.js b/test/ssh.test.js index bba41f7870..4d37191bba 100644 --- a/test/ssh.test.js +++ b/test/ssh.test.js @@ -28,7 +28,6 @@ test( expect(findings).toContainEqual({ category: 'SSH Service', - description: undefined, name: 'SSH Service Information', osi_layer: 'NETWORK', severity: 'INFORMATIONAL',