secureCodeBox · SebieF · Aug 4, 2021 · Aug 4, 2021 · Aug 4, 2021 · Aug 4, 2021
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -491,6 +491,7 @@ jobs:
           - ncrack
           - nikto
           - nmap
+          - pingcastle
           - nuclei
           - screenshooter
           - ssh-scan

diff --git a/scanners/amass/templates/amass-scan-type.yaml b/scanners/amass/templates/amass-scan-type.yaml
@@ -1,14 +1,13 @@
 # SPDX-FileCopyrightText: 2021 iteratec GmbH
 #
 # SPDX-License-Identifier: Apache-2.0
+
 apiVersion: "execution.securecodebox.io/v1"
 kind: ScanType
 metadata:
   name: "amass{{ .Values.scanner.nameAppend | default ""}}"
 spec:
   extractResults:
-    # amass saves it's result now in json but in "json lines" format
-    # http://jsonlines.org/
     type: amass-jsonl
     location: "/home/securecodebox/amass-results.jsonl"
   jobTemplate:

diff --git a/scanners/kube-hunter/templates/kubehunter-scan-type.yaml b/scanners/kube-hunter/templates/kubehunter-scan-type.yaml
@@ -2,14 +2,14 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-apiVersion: 'execution.securecodebox.io/v1'
+apiVersion: "execution.securecodebox.io/v1"
 kind: ScanType
 metadata:
-  name: 'kube-hunter{{ .Values.scanner.nameAppend | default ""}}'
+  name: "kube-hunter{{ .Values.scanner.nameAppend | default ""}}"
 spec:
   extractResults:
     type: kube-hunter-json
-    location: '/home/securecodebox/kube-hunter-results.json'
+    location: "/home/securecodebox/kube-hunter-results.json"
   jobTemplate:
     spec:
       {{- if .Values.scanner.ttlSecondsAfterFinished }}
@@ -27,10 +27,10 @@ spec:
               image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"
               imagePullPolicy: {{ .Values.scanner.image.pullPolicy }}
               command:
-                - 'sh'
-                - '/wrapper.sh'
-                - '--report'
-                - 'json'
+                - "sh"
+                - "/wrapper.sh"
+                - "--report"
+                - "json"
               resources:
                 {{- toYaml .Values.scanner.resources | nindent 16 }}
               securityContext:

diff --git a/scanners/kubeaudit/templates/kubeaudit-scan-type.yaml b/scanners/kubeaudit/templates/kubeaudit-scan-type.yaml
@@ -46,5 +46,5 @@ spec:
             {{- toYaml .Values.scanner.extraContainers | nindent 12 }}
             {{- end }}
           volumes:
-            {{- toYaml .Values.scanner.extraVolumeMounts | nindent 12 }}
+            {{- toYaml .Values.scanner.extraVolumes | nindent 12 }}
           serviceAccountName: kubeaudit
diff --git a/scanners/ncrack/templates/ncrack-scan-type.yaml b/scanners/ncrack/templates/ncrack-scan-type.yaml
@@ -26,7 +26,10 @@ spec:
             - name: ncrack
               image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"
               imagePullPolicy: {{ .Values.scanner.image.pullPolicy }}
-              command: ["ncrack", "-oX", "/home/securecodebox/ncrack-results.xml"]
+              command:
+                - "ncrack"
+                - "-oX"
+                - "/home/securecodebox/ncrack-results.xml"
               resources:
                 {{- toYaml .Values.scanner.resources | nindent 16 }}
               securityContext:

diff --git a/scanners/nikto/templates/nikto-scan-type.yaml b/scanners/nikto/templates/nikto-scan-type.yaml
@@ -2,14 +2,14 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-apiVersion: 'execution.securecodebox.io/v1'
+apiVersion: "execution.securecodebox.io/v1"
 kind: ScanType
 metadata:
-  name: 'nikto{{ .Values.scanner.nameAppend | default ""}}'
+  name: "nikto{{ .Values.scanner.nameAppend | default ""}}"
 spec:
   extractResults:
     type: nikto-json
-    location: '/home/securecodebox/nikto-results.json'
+    location: "/home/securecodebox/nikto-results.json"
   jobTemplate:
     spec:
       {{- if .Values.scanner.ttlSecondsAfterFinished }}
@@ -27,12 +27,10 @@ spec:
               image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"
               imagePullPolicy: {{ .Values.scanner.image.pullPolicy }}
               command:
-                # Nikto Entrypoint Script to avoid problems nikto exiting with a non zero exit code
-                # This would cause the kubernetes job to fail no matter what
-                - 'sh'
-                - '/wrapper.sh'
-                - '-o'
-                - '/home/securecodebox/nikto-results.json'
+                - "sh"
+                - "/wrapper.sh"
+                - "-o"
+                - "/home/securecodebox/nikto-results.json"
               resources:
                 {{- toYaml .Values.scanner.resources | nindent 16 }}
               securityContext:

diff --git a/scanners/nmap/templates/nmap-scan-type.yaml b/scanners/nmap/templates/nmap-scan-type.yaml
@@ -26,7 +26,10 @@ spec:
             - name: nmap
               image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"
               imagePullPolicy: {{ .Values.scanner.image.pullPolicy }}
-              command: ["nmap", "-oX", "/home/securecodebox/nmap-results.xml"]
+              command:
+                - "nmap"
+                - "-oX"
+                - "/home/securecodebox/nmap-results.xml"
               resources:
                 {{- toYaml .Values.scanner.resources | nindent 16 }}
               securityContext:

diff --git a/scanners/nuclei/templates/nuclei-scan-type.yaml b/scanners/nuclei/templates/nuclei-scan-type.yaml
@@ -2,14 +2,14 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-apiVersion: 'execution.securecodebox.io/v1'
+apiVersion: "execution.securecodebox.io/v1"
 kind: ScanType
 metadata:
-  name: 'nuclei{{ .Values.scanner.nameAppend | default ""}}'
+  name: "nuclei{{ .Values.scanner.nameAppend | default ""}}"
 spec:
   extractResults:
     type: nuclei-json
-    location: '/home/securecodebox/nuclei-results.jsonl'
+    location: "/home/securecodebox/nuclei-results.jsonl"
   jobTemplate:
     spec:
       {{- if .Values.scanner.ttlSecondsAfterFinished }}
@@ -27,12 +27,11 @@ spec:
               image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"
               imagePullPolicy: {{ .Values.scanner.image.pullPolicy }}
               command:
-                - 'nuclei'
-                - '-no-update-templates'
-                - '-json'
-                # nuclei writes json lines: https://jsonlines.org/
-                - '-output'
-                - '/home/securecodebox/nuclei-results.jsonl'
+                - "nuclei"
+                - "-no-update-templates"
+                - "-json"
+                - "-output"
+                - "/home/securecodebox/nuclei-results.jsonl"
               resources:
                 {{- toYaml .Values.scanner.resources | nindent 16 }}
               securityContext:

diff --git a/scanners/pingcastle/.helm-docs.gotmpl b/scanners/pingcastle/.helm-docs.gotmpl
@@ -0,0 +1,53 @@
+{{- /*
+SPDX-FileCopyrightText: 2021 iteratec GmbH
+
+SPDX-License-Identifier: Apache-2.0
+*/ -}}
+
+{{- define "extra.docsSection" -}}
+---
+title: "PingCastle"
+category: "scanner"
+type: "Application"
+state: "template"
+appVersion: "2.9.2.1"
+usecase: "Active Directory scanning"
+---
+
+![Pingcastle logo](https://www.pingcastle.com/wp/wp-content/uploads/2018/09/pingcastle_big.png)
+
+{{- end }}
+
+{{- define "extra.communitySection" -}}
+PingCastle is a Windows application. The secureCodeBox, however, operates with linux containers only to date.
+That is why we only provide a template for the scanner implementation and the parser to convert pingcastle results to
+secureCodeBox [findings](https://docs.securecodebox.io/docs/api/finding).
+Furthermore, we also provide a tutorial (scanner/Tutorial.md) that describes one way to make it work.
+Unfortunately the resulting docker image cannot be provided due to licensing.
+
+You can find more information about our process to integrate Windows security scanners in this
+[blog post](https://docs.securecodebox.io/blog/2021/08/09/integrating-windows-scanners).
+If you have any suggestions or requests regarding the implementation of PingCastle or any other windows scanner,
+please let us know!

+{{- end }}
+
+{{- define "extra.chartAboutSection" -}}
+## What is PingCastle?
+PingCastle is an open-source tool to scan a company's active directory. It is able to identify potential security
+risks and anomalies, regarding password settings, account privileges and much more. It is free to use for non-commercial
+use, otherwise a commercial license has to be purchased.
+
+To learn more about the PingCastle itself visit [pingcastle.com].
+{{- end }}
+
+{{- define "extra.scannerConfigurationSection" -}}
+## Scanner Configuration
+
+At the moment we only provide support for "healthchecks" that check the security issues mentioned above.
+
+- `--healthcheck`: Basic command to run pingcastle in healthcheck mode
+- `--server` xx: Replace xx with the domain name to scan.
+{{- end }}
+
+
diff --git a/scanners/pingcastle/Chart.yaml b/scanners/pingcastle/Chart.yaml
@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v2
+name: pingcastle
+description: A Helm chart for the pingcastle security Scanner that integrates with the secureCodeBox.
+
+type: application
+# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
+version: v3.1.0-alpha1
+appVersion: "v2.9.2.1"
+kubeVersion: ">=v1.11.0-0"
+
+keywords:
+  - security
+  - pingcastle
+  - scanner
+  - active directory
+  - windows
+  - secureCodeBox
+home: https://docs.securecodebox.io/docs/scanners/pingcastle
+icon: https://docs.securecodebox.io/img/integrationIcons/pingcastle.svg
+sources:
+  - https://github.com/secureCodeBox/secureCodeBox
+maintainers:
+  - name: iteratec GmbH
+    email: secureCodeBox@iteratec.com
diff --git a/scanners/pingcastle/README.md b/scanners/pingcastle/README.md
@@ -0,0 +1,154 @@
+---
+title: "PingCastle"
+category: "scanner"
+type: "Application"
+state: "template"
+appVersion: "2.9.2.1"
+usecase: "Active Directory scanning"
+---
+
+![Pingcastle logo](https://www.pingcastle.com/wp/wp-content/uploads/2018/09/pingcastle_big.png)
+
+<!--
+SPDX-FileCopyrightText: 2021 iteratec GmbH
+
+SPDX-License-Identifier: Apache-2.0
+-->
+<!--
+.: IMPORTANT! :.
+--------------------------
+This file is generated automatically with `helm-docs` based on the following template files:
+- ./.helm-docs/templates.gotmpl (general template data for all charts)
+- ./chart-folder/.helm-docs.gotmpl (chart specific template data)
+
+Please be aware of that and apply your changes only within those template files instead of this file.
+Otherwise your changes will be reverted/overwritten automatically due to the build process `./.github/workflows/helm-docs.yaml`
+--------------------------
+-->
+
+<p align="center">
+  <a href="https://opensource.org/licenses/Apache-2.0"><img alt="License Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/releases/latest"><img alt="GitHub release (latest SemVer)" src="https://img.shields.io/github/v/release/secureCodeBox/secureCodeBox?sort=semver"/></a>
+  <a href="https://owasp.org/www-project-securecodebox/"><img alt="OWASP Incubator Project" src="https://img.shields.io/badge/OWASP-Incubator%20Project-365EAA"/></a>
+  <a href="https://artifacthub.io/packages/search?repo=securecodebox"><img alt="Artifact HUB" src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/securecodebox"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/"><img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/secureCodeBox/secureCodeBox?logo=GitHub"/></a>
+  <a href="https://twitter.com/securecodebox"><img alt="Twitter Follower" src="https://img.shields.io/twitter/follow/securecodebox?style=flat&color=blue&logo=twitter"/></a>
+</p>
+
+## What is NMAP?
+Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
+
+To learn more about the Nmap scanner itself visit [nmap.org].
+
+## Deployment
+The nmap chart can be deployed via helm:
+
+```bash
+# Install HelmChart (use -n to configure another namespace)
+helm upgrade --install nmap secureCodeBox/nmap
+```
+
+## Scanner Configuration
+
+The Nmap scan targets are specified as the last parameter. The target should be a hostname, an IP address or an IP range. See [Nmap Docs](https://nmap.org/book/man-target-specification.html) for details.
+
+Additional Nmap scan features can be configured via the parameter attribute. For a detailed explanation to which parameters are available refer to the [Nmap Reference Guide](https://nmap.org/book/man.html). All parameters are supported, but be careful with parameters that require root level rights, as these require additional configuration on the ScanType to be supported.
+
+Some useful example parameters listed below:
+
+- `-p` xx: Scan ports of the target. Replace xx with a single port number or a range of ports.
+- `-PS`, `-PA`, `-PU` xx: Replace xx with the ports to scan. TCP SYN/ACK or
+  UDP discovery.
+- `-sV`: Determine service and version info.
+- `-O`: Determine OS info. **Note:** This requires that Nmap is run as root, or that the user has the system capabilities to be extended to allow Nmap to send raw sockets. See more information on [how to deploy the secureCodeBox nmap container to allow this](https://github.com/secureCodeBox/scanner-infrastructure-nmap/pull/20) and the [nmap docs about privileged scans](https://secwiki.org/w/Running_nmap_as_an_unprivileged_user)
+- `-A`: Determine service/version and OS info.
+- `-script` xx: Replace xx with the script name. Start the scan with the given script.
+- `--script` xx: Replace xx with a coma-separated list of scripts. Start the scan with the given scripts.
+
+## Requirements
+
+Kubernetes: `>=v1.11.0-0`
+
+## Additional Chart Configurations
+### Operating System Scans
+
+:::caution
+Warning! This is currently not tested and might require additional testing to work 😕
+:::
+
+If you want to use Nmap to identify operating systems of hosts you'll need to weaken the securityContext config, as Nmap requires the capability to send raw sockets to identify operating systems. See [Nmap Docs](https://secwiki.org/w/Running_nmap_as_an_unprivileged_user)
+
+You can deploy the ScanType with the config like this:
+
+```bash
+cat <<EOF | helm install nmap-privileged ./scanners/nmap --values -
+scanner:
+  nameAppend: "-privileged"
+  env:
+    - name: "NMAP_PRIVILEGED"
+      value: "true"
+  securityContext:
+    capabilities:
+      drop:
+        - all
+      add:
+        - CAP_NET_RAW
+        - CAP_NET_ADMIN
+        - CAP_NET_BIND_SERVICE
+EOF
+```
+
+Then, you can start scans with operating system identification enabled:
+
+```yaml
+apiVersion: "execution.securecodebox.io/v1"
+kind: Scan
+metadata:
+  name: "nmap-os-scan"
+spec:
+  scanType: "nmap-privileged"
+  parameters:
+    - --privileged
+    - "-O"
+    - www.iteratec.de
+```
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| cascadingRules.enabled | bool | `true` | Enables or disables the installation of the default cascading rules for this scanner |
+| parser.env | list | `[]` | Optional environment variables mapped into each parseJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
+| parser.image.repository | string | `"docker.io/securecodebox/parser-nmap"` | Parser image repository |
+| parser.image.tag | string | defaults to the charts appVersion | Parser image tag |
+| parser.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
+| scanner.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) |
+| scanner.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
+| scanner.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) |
+| scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
+| scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
+| scanner.image.repository | string | `"docker.io/securecodebox/scanner-nmap"` | Container Image to run the scan |
+| scanner.image.tag | string | `nil` | defaults to the charts version |
+| scanner.nameAppend | string | `nil` | append a string to the default scantype name. |
+| scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
+| scanner.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
+| scanner.securityContext.allowPrivilegeEscalation | bool | `false` | Ensure that users privileges cannot be escalated |
+| scanner.securityContext.capabilities.drop[0] | string | `"all"` | This drops all linux privileges from the container. |
+| scanner.securityContext.privileged | bool | `false` | Ensures that the scanner container is not run in privileged mode |
+| scanner.securityContext.readOnlyRootFilesystem | bool | `true` | Prevents write access to the containers file system |
+| scanner.securityContext.runAsNonRoot | bool | `true` | Enforces that the scanner image is run as a non root user |
+| scanner.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
+
+## License
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+
+Code of secureCodeBox is licensed under the [Apache License 2.0][scb-license].
+
+[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox
+[scb-docs]: https://docs.securecodebox.io/
+[scb-site]: https://www.securecodebox.io/
+[scb-github]: https://github.com/secureCodeBox/
+[scb-twitter]: https://twitter.com/secureCodeBox
+[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU
+[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE
+
diff --git a/scanners/pingcastle/docs/.gitkeep b/scanners/pingcastle/docs/.gitkeep
-Original file line number
+Diff line change
@@ Expand Up / @@ -491,6 +491,7 @@ jobs: @@
               - ncrack
               - nikto
               - nmap
+              - pingcastle
               - nuclei
               - screenshooter
               - ssh-scan
@@ Expand Down @@