From 08383f95f41aad9f5a907d4feac8d1034205e4ac Mon Sep 17 00:00:00 2001 From: secureCodeBoxBot Date: Fri, 4 Mar 2022 09:26:36 +0000 Subject: [PATCH 1/6] Upgrading nuclei from v2.6.2 to v2.6.3 Signed-off-by: secureCodeBoxBot --- scanners/nuclei/Chart.yaml | 2 +- scanners/nuclei/README.md | 2 +- scanners/nuclei/docs/README.DockerHub-Parser.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/scanners/nuclei/Chart.yaml b/scanners/nuclei/Chart.yaml index de8c63ffde..e8b0a4cb3f 100644 --- a/scanners/nuclei/Chart.yaml +++ b/scanners/nuclei/Chart.yaml @@ -8,7 +8,7 @@ description: A Helm chart for the nuclei security scanner that integrates with t type: application # version - gets automatically set to the secureCodeBox release version when the helm charts gets published version: v3.1.0-alpha1 -appVersion: "v2.6.2" +appVersion: "v2.6.3" kubeVersion: ">=v1.11.0-0" annotations: versionApi: https://api.github.com/repos/projectdiscovery/nuclei/releases/latest diff --git a/scanners/nuclei/README.md b/scanners/nuclei/README.md index 6e03963998..0cad57c77b 100644 --- a/scanners/nuclei/README.md +++ b/scanners/nuclei/README.md @@ -3,7 +3,7 @@ title: "Nuclei" category: "scanner" type: "Website" state: "released" -appVersion: "v2.6.2" +appVersion: "v2.6.3" usecase: "Nuclei is a fast, template based vulnerability scanner." --- diff --git a/scanners/nuclei/docs/README.DockerHub-Parser.md b/scanners/nuclei/docs/README.DockerHub-Parser.md index ea4cf0e498..f292b63dbf 100644 --- a/scanners/nuclei/docs/README.DockerHub-Parser.md +++ b/scanners/nuclei/docs/README.DockerHub-Parser.md @@ -42,7 +42,7 @@ You can find resources to help you get started on our [documentation website](ht ## Supported Tags - `latest` (represents the latest stable release build) -- tagged releases, e.g. `v2.6.2` +- tagged releases, e.g. `v2.6.3` ## How to use this image This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more information details please take a look at the documentation page: https://docs.securecodebox.io/docs/scanners/nuclei. From c1a08911e853ba2c52287eb390dfe1d9738a38b3 Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Thu, 24 Mar 2022 00:09:47 +0100 Subject: [PATCH 2/6] Added a new integration-test for nuclei --- scanners/nuclei/Makefile | 7 ++- .../nuclei/integration-tests/nuclei.test.js | 43 +++++++++++++++++++ 2 files changed, 46 insertions(+), 4 deletions(-) create mode 100644 scanners/nuclei/integration-tests/nuclei.test.js diff --git a/scanners/nuclei/Makefile b/scanners/nuclei/Makefile index 8a1e0fa4bc..93ae39f48b 100644 --- a/scanners/nuclei/Makefile +++ b/scanners/nuclei/Makefile @@ -15,9 +15,8 @@ deploy-without-scanner: helm -n integration-tests upgrade --install $(name) ./ --wait \ --set="parser.image.repository=docker.io/$(IMG_NS)/$(parser-prefix)-$(name)" \ --set="parser.image.tag=$(IMG_TAG)" \ - --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ - --set-string="parser.env[0].value=true" \ - --set="scanner.image.repository=docker.io/$(IMG_NS)/$(scanner-prefix)-$(name)" \ - --set="scanner.image.tag=$(IMG_TAG)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" \ --set="nucleiTemplateCache.enabled=false" +deploy-test-deps: deploy-test-dep-bodgeit diff --git a/scanners/nuclei/integration-tests/nuclei.test.js b/scanners/nuclei/integration-tests/nuclei.test.js new file mode 100644 index 0000000000..bbdef11463 --- /dev/null +++ b/scanners/nuclei/integration-tests/nuclei.test.js @@ -0,0 +1,43 @@ +// SPDX-FileCopyrightText: the secureCodeBox authors +// +// SPDX-License-Identifier: Apache-2.0 + +const {scan} = require("../../helpers"); + +jest.retryTimes(3); + +// test( +// "Nuclei scan for a vulnerable bodgeit demo target", +// async () => { +// const { categories, severities, count } = await scan( +// "nuclei-juiceshop", +// "nuclei", +// ["-no-interactsh", "-u", "http://bodgeit.demo-targets.svc:8080"], +// 180 +// ); + +// expect(count).toBeGreaterThanOrEqual(4); +// // expect(categories["Image Vulnerability"]).toBeGreaterThanOrEqual(10); +// // expect(categories["NPM Package Vulnerability"]).toBeGreaterThanOrEqual(30); +// // expect(severities["high"]).toBeGreaterThanOrEqual(20); +// // expect(severities["medium"]).toBeGreaterThanOrEqual(10); +// expect(severities["low"]).toBeGreaterThanOrEqual(1); +// }, +// 3 * 60 * 1000 +// ); + +test( + "Nuclei scan for a vulnerable demo target", + async () => { + const { categories, severities, count } = await scan( + "nuclei-scb", + "nuclei", + ["-no-interactsh", "-u", "http://www.secureCodeBox.io"], + 180 + ); + + expect(count).toBeGreaterThanOrEqual(1); + expect(severities["informational"]).toBeGreaterThanOrEqual(1); + }, + 3 * 60 * 1000 +); \ No newline at end of file From c796f2e45d417cb65cb5370e1117bb6233813a75 Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Thu, 24 Mar 2022 00:10:33 +0100 Subject: [PATCH 3/6] New mapping of unkown severity due to documentation --- scanners/nuclei/parser/parser.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scanners/nuclei/parser/parser.js b/scanners/nuclei/parser/parser.js index c5490a48a9..7576ba34e9 100644 --- a/scanners/nuclei/parser/parser.js +++ b/scanners/nuclei/parser/parser.js @@ -40,8 +40,9 @@ function getAdjustedSeverity(severity) { case "CRITICAL": return "HIGH"; case "INFO": - case "UNKNOWN": return "INFORMATIONAL"; + case "UNKNOWN": + return "LOW"; default: return severity; } From e3bc92cc6013a045f8048bb37c1b836dcc0f65c6 Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Thu, 24 Mar 2022 00:10:54 +0100 Subject: [PATCH 4/6] Upgraded to latest version --- scanners/nuclei/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanners/nuclei/Chart.yaml b/scanners/nuclei/Chart.yaml index e8b0a4cb3f..82ed74b459 100644 --- a/scanners/nuclei/Chart.yaml +++ b/scanners/nuclei/Chart.yaml @@ -8,7 +8,7 @@ description: A Helm chart for the nuclei security scanner that integrates with t type: application # version - gets automatically set to the secureCodeBox release version when the helm charts gets published version: v3.1.0-alpha1 -appVersion: "v2.6.3" +appVersion: "v2.6.5" kubeVersion: ">=v1.11.0-0" annotations: versionApi: https://api.github.com/repos/projectdiscovery/nuclei/releases/latest From aac3cbbce2e11462bd6a19efa3e6699f530ed7d7 Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Thu, 24 Mar 2022 00:11:25 +0100 Subject: [PATCH 5/6] Added all tar files (created during local build) to ignore list --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 546f5bf134..13524d4da8 100644 --- a/.gitignore +++ b/.gitignore @@ -42,6 +42,8 @@ Sessionx.vim # Temporary .netrwhist *~ +*.tar + # Auto-generated tag files tags # Persistent undo From 8dfed10e660f921da3371b73dbbb39b07fe5d9c4 Mon Sep 17 00:00:00 2001 From: rseedorff Date: Wed, 23 Mar 2022 23:11:56 +0000 Subject: [PATCH 6/6] Updating Helm Docs Signed-off-by: GitHub Actions --- scanners/nuclei/README.md | 2 +- scanners/nuclei/docs/README.DockerHub-Parser.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/nuclei/README.md b/scanners/nuclei/README.md index 0cad57c77b..e4c385296f 100644 --- a/scanners/nuclei/README.md +++ b/scanners/nuclei/README.md @@ -3,7 +3,7 @@ title: "Nuclei" category: "scanner" type: "Website" state: "released" -appVersion: "v2.6.3" +appVersion: "v2.6.5" usecase: "Nuclei is a fast, template based vulnerability scanner." --- diff --git a/scanners/nuclei/docs/README.DockerHub-Parser.md b/scanners/nuclei/docs/README.DockerHub-Parser.md index f292b63dbf..75915b5557 100644 --- a/scanners/nuclei/docs/README.DockerHub-Parser.md +++ b/scanners/nuclei/docs/README.DockerHub-Parser.md @@ -42,7 +42,7 @@ You can find resources to help you get started on our [documentation website](ht ## Supported Tags - `latest` (represents the latest stable release build) -- tagged releases, e.g. `v2.6.3` +- tagged releases, e.g. `v2.6.5` ## How to use this image This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more information details please take a look at the documentation page: https://docs.securecodebox.io/docs/scanners/nuclei.