Skip to content

Commit fab01bd

Browse files
J12934J12934
authored
Merge pull request #248 from secureCodeBox/scanner/acstis
New Scanner: AngularJS CSTI Scanner (closes #216)
2 parents 4de4a5c + 1935c38 commit fab01bd

File tree

21 files changed

+760
-0
lines changed

21 files changed

+760
-0
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,7 @@ jobs:
260260
matrix:
261261
parser:
262262
- amass
263+
- angularjs-csti-scanner
263264
- git-repo-scanner
264265
- gitleaks
265266
- kube-hunter
@@ -332,6 +333,7 @@ jobs:
332333
strategy:
333334
matrix:
334335
scanner:
336+
- angularjs-csti-scanner
335337
- gitleaks
336338
- kube-hunter
337339
- kubeaudit

‎scanners/angularjs-csti-scanner/.helmignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
.DS_Store
2+
3+
parser/
4+
scanner/
5+
examples/
6+

‎scanners/angularjs-csti-scanner/Chart.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: v1
2+
name: angularja-csti-scanner
3+
description: A Helm chart for the angularja csti scanner that integrates with the secureCodeBox.
4+
5+
type: application
6+
# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
7+
version: latest
8+
appVersion: 3.0.6
9+
kubeVersion: ">=v1.11.0-0"
10+
11+
keywords:
12+
- security
13+
- acstis
14+
- scanner
15+
- secureCodeBox
16+
home: https://docs.securecodebox.io/docs/scanners/angularja-csti-scanner
17+
icon: https://docs.securecodebox.io/img/integrationIcons/Acstis.svg
18+
sources:
19+
- https://github.com/secureCodeBox/secureCodeBox
20+
maintainers:
21+
- name: iteratec GmbH
22+
email: secureCodeBox@iteratec.com
23+

‎scanners/angularjs-csti-scanner/README.md‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
---
2+
title: "Angularjs CSTI Scanner"
3+
category: "scanner"
4+
type: "Repository"
5+
state: "in progress"
6+
usecase: "Find AngularJS websites vulnerable to template injections"
7+
---
8+
9+
![acstis logo](https://rawgit.com/tijme/angularjs-csti-scanner/master/.github/logo.svg?pypi=png.from.svg)
10+
11+
AngularJS Client-Side Template Injection Scanner (acstis) is a open source scanner for
12+
finding possible template injection vulnerabilities on websites using AngularJS.
13+
14+
For more information visit the projects github site <https://github.com/tijme/angularjs-csti-scanner>
15+
16+
## Deployment
17+
18+
The gitleaks scanner can be deployed with helm:
19+
20+
```bash
21+
helm upgrade --install acstis secureCodeBox/acstis
22+
```
23+
24+
## Scanner configuration
25+
26+
The only mandatory parameter is:
27+
- `-d`: The url to scan (e.g. https://angularjs.org/).
28+
29+
Optional arguments:
30+
31+
```bash
32+
-c, --crawl use the crawler to scan all the entire domain
33+
-vp, --verify-payload use a javascript engine to verify if the payload was executed (otherwise false positives may occur)
34+
-av ANGULAR_VERSION, --angular-version ANGULAR_VERSION manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work
35+
-vrl VULNERABLE_REQUESTS_LOG, --vulnerable-requests-log VULNERABLE_REQUESTS_LOG log all vulnerable requests to this file (e.g. /var/logs/acstis.log or urls.log)
36+
-siv, --stop-if-vulnerable (crawler option) stop scanning if a vulnerability was found
37+
-pmm, --protocol-must-match (crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)
38+
-sos, --scan-other-subdomains (crawler option) also scan pages that have another subdomain than the startpoint
39+
-soh, --scan-other-hostnames (crawler option) also scan pages that have another hostname than the startpoint
40+
-sot, --scan-other-tlds (crawler option) also scan pages that have another tld than the startpoint
41+
-md MAX_DEPTH, --max-depth MAX_DEPTH (crawler option) the maximum search depth (default is unlimited)
42+
-mt MAX_THREADS, --max-threads MAX_THREADS (crawler option) the maximum amount of simultaneous threads to use (default is 20)
43+
-iic, --ignore-invalid-certificates (crawler option) ignore invalid ssl certificates
44+
```
45+
46+
**Do not** override the option `-vrl` or `--vulnerable-requests-log`. It is already configured for automatic findings parsing.
47+
48+
### Request configuration
49+
50+
Because *acstis* does not provide provide command line arguments for configuring the sent requests,
51+
you have to mount a config map into the scan container on a specific location. Your additional config map should be
52+
mounted to `/acstis/config/acstis-config.py`. For example create a config map:
53+
54+
```bash
55+
kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config
56+
```
57+
58+
And mount it into the container:
59+
60+
```yaml
61+
volumes:
62+
- name: "acstis-config"
63+
configMap:
64+
name: "acstis-config"
65+
volumeMounts:
66+
- name: "acstis-config"
67+
mountPath: "/acstis/config/"
68+
```
69+
70+
#### Configuration options in *acstis-config.py*
71+
72+
Add the following snippets to the *acstis-config.py* file to enable further options.
73+
The options are python code which will be injected into the *acstis* script before execution.
74+
75+
**Basic Authentication**
76+
```text
77+
options.identity.auth = HTTPBasicAuth("username", "password")
78+
```
79+
80+
**Cookies**
81+
```text
82+
options.identity.cookies.set(name='tasty_cookie', value='yum', domain='finnwea.com', path='/cookies')
83+
options.identity.cookies.set(name='gross_cookie', value='blech', domain='finnwea.com', path='/elsewhere')
84+
```
85+
86+
**Headers**
87+
```text
88+
options.identity.headers.update({
89+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36",
90+
"Authorization": "Bearer ey3jafoe.2jefo..."
91+
})
92+
```
93+
94+
**Proxies**
95+
```text
96+
options.identity.proxies = {
97+
# No authentication
98+
# 'http': 'http://host:port',
99+
# 'https': 'http://host:port',
100+
101+
# Basic authentication
102+
# 'http': 'http://user:pass@host:port',
103+
# 'https': 'https://user:pass@host:port',
104+
105+
# SOCKS
106+
'http': 'socks5://user:pass@host:port',
107+
'https': 'socks5://user:pass@host:port'
108+
}
109+
```
110+
111+
**Scope options**
112+
```text
113+
options.scope.protocol_must_match = False
114+
115+
options.scope.subdomain_must_match = True
116+
117+
options.scope.hostname_must_match = True
118+
119+
options.scope.tld_must_match = True
120+
121+
options.scope.max_depth = None
122+
123+
options.scope.request_methods = [
124+
Request.METHOD_GET,
125+
Request.METHOD_POST,
126+
Request.METHOD_PUT,
127+
Request.METHOD_DELETE,
128+
Request.METHOD_OPTIONS,
129+
Request.METHOD_HEAD
130+
]
131+
```
132+
133+
## Chart Configuration
134+
135+
| Key | Type | Default | Description |
136+
|-----|------|---------|-------------|
137+
| image.repository | string | `"docker.io/securecodebox/scanner-acstis"` | Container Image to run the scan |
138+
| image.tag | string | `nil` | defaults to the charts version |
139+
| parseJob.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
140+
| parserImage.repository | string | `"docker.io/securecodebox/parser-acstis"` | Parser image repository |
141+
| parserImage.tag | string | defaults to the charts version | Parser image tag |
142+
| scannerJob.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
143+
| scannerJob.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) |
144+
| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
145+
| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
146+
| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
147+
| scannerJob.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
148+
| scannerJob.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
149+

‎scanners/angularjs-csti-scanner/README.md.gotmpl‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
---
2+
title: "Angularjs CSTI Scanner"
3+
category: "scanner"
4+
type: "Repository"
5+
state: "in progress"
6+
usecase: "Find AngularJS websites vulnerable to template injections"
7+
---
8+
9+
![acstis logo](https://rawgit.com/tijme/angularjs-csti-scanner/master/.github/logo.svg?pypi=png.from.svg)
10+
11+
AngularJS Client-Side Template Injection Scanner (acstis) is a open source scanner for
12+
finding possible template injection vulnerabilities on websites using AngularJS.
13+
14+
For more information visit the projects github site <https://github.com/tijme/angularjs-csti-scanner>
15+
16+
## Deployment
17+
18+
The gitleaks scanner can be deployed with helm:
19+
20+
```bash
21+
helm upgrade --install acstis secureCodeBox/acstis
22+
```
23+
24+
## Scanner configuration
25+
26+
The only mandatory parameter is:
27+
- `-d`: The url to scan (e.g. https://angularjs.org/).
28+
29+
Optional arguments:
30+
31+
```bash
32+
-c, --crawl use the crawler to scan all the entire domain
33+
-vp, --verify-payload use a javascript engine to verify if the payload was executed (otherwise false positives may occur)
34+
-av ANGULAR_VERSION, --angular-version ANGULAR_VERSION manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work
35+
-vrl VULNERABLE_REQUESTS_LOG, --vulnerable-requests-log VULNERABLE_REQUESTS_LOG log all vulnerable requests to this file (e.g. /var/logs/acstis.log or urls.log)
36+
-siv, --stop-if-vulnerable (crawler option) stop scanning if a vulnerability was found
37+
-pmm, --protocol-must-match (crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)
38+
-sos, --scan-other-subdomains (crawler option) also scan pages that have another subdomain than the startpoint
39+
-soh, --scan-other-hostnames (crawler option) also scan pages that have another hostname than the startpoint
40+
-sot, --scan-other-tlds (crawler option) also scan pages that have another tld than the startpoint
41+
-md MAX_DEPTH, --max-depth MAX_DEPTH (crawler option) the maximum search depth (default is unlimited)
42+
-mt MAX_THREADS, --max-threads MAX_THREADS (crawler option) the maximum amount of simultaneous threads to use (default is 20)
43+
-iic, --ignore-invalid-certificates (crawler option) ignore invalid ssl certificates
44+
```
45+
46+
**Do not** override the option `-vrl` or `--vulnerable-requests-log`. It is already configured for automatic findings parsing.
47+
48+
### Request configuration
49+
50+
Because *acstis* does not provide provide command line arguments for configuring the sent requests,
51+
you have to mount a config map into the scan container on a specific location. Your additional config map should be
52+
mounted to `/acstis/config/acstis-config.py`. For example create a config map:
53+
54+
```bash
55+
kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config
56+
```
57+
58+
And mount it into the container:
59+
60+
```yaml
61+
volumes:
62+
- name: "acstis-config"
63+
configMap:
64+
name: "acstis-config"
65+
volumeMounts:
66+
- name: "acstis-config"
67+
mountPath: "/acstis/config/"
68+
```
69+
70+
#### Configuration options in *acstis-config.py*
71+
72+
Add the following snippets to the *acstis-config.py* file to enable further options.
73+
The options are python code which will be injected into the *acstis* script before execution.
74+
75+
**Basic Authentication**
76+
```text
77+
options.identity.auth = HTTPBasicAuth("username", "password")
78+
```
79+
80+
**Cookies**
81+
```text
82+
options.identity.cookies.set(name='tasty_cookie', value='yum', domain='finnwea.com', path='/cookies')
83+
options.identity.cookies.set(name='gross_cookie', value='blech', domain='finnwea.com', path='/elsewhere')
84+
```
85+
86+
**Headers**
87+
```text
88+
options.identity.headers.update({
89+
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36",
90+
"Authorization": "Bearer ey3jafoe.2jefo..."
91+
})
92+
```
93+
94+
**Proxies**
95+
```text
96+
options.identity.proxies = {
97+
# No authentication
98+
# 'http': 'http://host:port',
99+
# 'https': 'http://host:port',
100+
101+
# Basic authentication
102+
# 'http': 'http://user:pass@host:port',
103+
# 'https': 'https://user:pass@host:port',
104+
105+
# SOCKS
106+
'http': 'socks5://user:pass@host:port',
107+
'https': 'socks5://user:pass@host:port'
108+
}
109+
```
110+
111+
**Scope options**
112+
```text
113+
options.scope.protocol_must_match = False
114+
115+
options.scope.subdomain_must_match = True
116+
117+
options.scope.hostname_must_match = True
118+
119+
options.scope.tld_must_match = True
120+
121+
options.scope.max_depth = None
122+
123+
options.scope.request_methods = [
124+
Request.METHOD_GET,
125+
Request.METHOD_POST,
126+
Request.METHOD_PUT,
127+
Request.METHOD_DELETE,
128+
Request.METHOD_OPTIONS,
129+
Request.METHOD_HEAD
130+
]
131+
```
132+
133+
## Chart Configuration
134+
135+
{{ template "chart.valuesTable" . }}
136+

‎scanners/angularjs-csti-scanner/examples/scan-single-url/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
This example scans a single URL.

‎scanners/angularjs-csti-scanner/examples/scan-single-url/scan.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: "execution.securecodebox.io/v1"
2+
kind: Scan
3+
metadata:
4+
name: "scan-single-url"
5+
spec:
6+
scanType: "angularjs-csti-scanner"
7+
parameters:
8+
- "-d"
9+
- "https://example.com"

‎scanners/angularjs-csti-scanner/examples/scan-website-with-options/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
To add some headers to the scanners requests create a file called *acstis-config.py* with the following content:
2+
3+
```text
4+
options.identity.headers.update({
5+
"Authorization": "Bearer <JWT>"
6+
})
7+
```
8+
9+
Then create a config map from this file:
10+
11+
```bash
12+
kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config
13+
```
14+
15+
After mounting the config map to the specified path you can execute your scan.

‎scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: "execution.securecodebox.io/v1"
2+
kind: Scan
3+
metadata:
4+
name: "scan-website-with-jwt"
5+
spec:
6+
scanType: "angularjs-csti-scanner"
7+
parameters:
8+
- "-d"
9+
- "https://example.com"
10+
- "-c"
11+
# you should always specify a max depth when crawling
12+
- "-md"
13+
- "3"
14+
volumes:
15+
- name: "acstis-config"
16+
configMap:
17+
name: "acstis-config"
18+
volumeMounts:
19+
- name: "acstis-config"
20+
mountPath: "/acstis/config/"

0 commit comments

Comments
 (0)