Skip to content
This repository was archived by the owner on Feb 26, 2021. It is now read-only.

Commit f055cb9

Browse files
J12934J12934
authored
Develop (#2)
Develop
2 parents 5371d7a + 2a5fe99 commit f055cb9

15 files changed

Lines changed: 653 additions & 1 deletion

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,5 @@ build-iPhoneSimulator/
4848

4949
# unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
5050
.rvmrc
51+
52+
/.idea/

‎.travis.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
language: ruby
2+
rvm:
3+
- 2.5
4+
jobs:
5+
include:
6+
- stage: test
7+
script: rake test
8+
- stage: build docker image
9+
services:
10+
- docker
11+
script:
12+
- export REPO=securecodebox/wpscan
13+
- export TAG=$(echo $TRAVIS_BRANCH | sed 's/\//-/g')
14+
- echo -en "travis_fold:start:Docker_Build\r"
15+
- docker build -t $REPO:$TAG --build-arg="BUILD_DATE=$(date --rfc-3339=seconds)" --build-arg=VERSION=$TRAVIS_TAG --build-arg=COMMIT_ID=$TRAVIS_COMMIT --build-arg=BRANCH=$TRAVIS_BRANCH --build-arg=REPOSITORY_URL="https://github.com/secureCodeBox/scanner-cms-wpscan" .
16+
- echo -en "travis_fold:end:Docker_Build\r"
17+
- docker images
18+
deploy:
19+
- provider: script
20+
skip_cleanup: true
21+
script: bash .travis/deployDockerHub.sh
22+
on:
23+
all_branches: true

‎.travis/deployDockerHub.sh‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/bin/bash
2+
3+
echo "Docker Login"
4+
echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
5+
echo "Pushing to Dockerhub"
6+
7+
if [[ $TRAVIS_BRANCH =~ ^develop$ ]]
8+
then
9+
echo "Develop Build: Pushing develop tag"
10+
11+
echo $(docker tag $REPO:$TAG $REPO:develop)
12+
echo $(docker tag $REPO:$TAG $REPO:develop-$TRAVIS_BUILD_NUMBER)
13+
14+
echo $(docker push $REPO:develop)
15+
echo $(docker push $REPO:develop-$TRAVIS_BUILD_NUMBER)
16+
elif [ "$TRAVIS_BRANCH" = "$TRAVIS_TAG" ]
17+
then
18+
echo "Tagged Release: Pushing versioned docker image."
19+
echo $(docker tag $REPO:$TAG $REPO:$TRAVIS_TAG)
20+
echo $(docker tag $REPO:$TAG $REPO:latest)
21+
echo $(docker push $REPO:$TRAVIS_TAG)
22+
echo $(docker push $REPO:latest)
23+
else
24+
echo "Feature Branch: Pushing only branch Tag"
25+
echo $(docker push $REPO:$TAG)
26+
fi

‎Dockerfile‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
FROM ruby:alpine
2+
3+
WORKDIR /sectools
4+
ADD Gemfile /sectools
5+
6+
RUN apk --update add --virtual build-dependencies ruby-dev build-base &&\
7+
apk --update add curl &&\
8+
apk --update add git
9+
10+
RUN gem install wpscan bundler &&\
11+
bundle install &&\
12+
apk del build-dependencies && \
13+
rm -rf /var/cache/apk/*
14+
15+
COPY . /wpscan
16+
17+
HEALTHCHECK --interval=30s --timeout=5s --start-period=120s --retries=3 CMD curl --fail http://localhost:8080/status || exit 1
18+
19+
COPY src/ src/
20+
21+
RUN addgroup --system wpscan && \
22+
adduser --system wpscan
23+
24+
RUN chgrp -R 0 /sectools/ && \
25+
chmod -R g=u /sectools/ && \
26+
chown -R wpscan /sectools/
27+
28+
USER wpscan
29+
30+
EXPOSE 8080
31+
32+
ARG COMMIT_ID=unkown
33+
ARG REPOSITORY_URL=unkown
34+
ARG BRANCH=unkown
35+
ARG BUILD_DATE
36+
ARG VERSION
37+
38+
ENV SCB_COMMIT_ID ${COMMIT_ID}
39+
ENV SCB_REPOSITORY_URL ${REPOSITORY_URL}
40+
ENV SCB_BRANCH ${BRANCH}
41+
42+
LABEL org.opencontainers.image.title="secureCodeBox scanner-webserver-wordpress" \
43+
org.opencontainers.image.description="Wordpress_Scan integration for secureCodeBox" \
44+
org.opencontainers.image.authors="iteratec GmbH" \
45+
org.opencontainers.image.vendor="iteratec GmbH" \
46+
org.opencontainers.image.documentation="https://github.com/secureCodeBox/secureCodeBox" \
47+
org.opencontainers.image.licenses="Apache-2.0" \
48+
org.opencontainers.image.version=$VERSION \
49+
org.opencontainers.image.url=$REPOSITORY_URL \
50+
org.opencontainers.image.source=$REPOSITORY_URL \
51+
org.opencontainers.image.revision=$COMMIT_ID \
52+
org.opencontainers.image.created=$BUILD_DATE
53+
54+
ENTRYPOINT ["ruby","/sectools/src/main.rb"]

‎Gemfile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
source 'https://rubygems.org'
2+
3+
gem "sinatra"
4+
gem "rest-client"
5+
gem "wpscan", "3.5.4"
6+
7+
gem "ruby-scanner-scaffolding", :git => "https://github.com/secureCodeBox/ruby-scanner-scaffolding.git", :tag => "v1.0.0"

‎Gemfile.lock‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
GIT
2+
remote: https://github.com/secureCodeBox/ruby-scanner-scaffolding.git
3+
revision: fff6c92edffb1f55bde432156ffd60c38c034e49
4+
tag: v1.0.0
5+
specs:
6+
ruby-scanner-scaffolding (1.0.0)
7+
8+
GEM
9+
remote: https://rubygems.org/
10+
specs:
11+
activesupport (5.2.3)
12+
concurrent-ruby (~> 1.0, >= 1.0.2)
13+
i18n (>= 0.7, < 2)
14+
minitest (~> 5.1)
15+
tzinfo (~> 1.1)
16+
addressable (2.6.0)
17+
public_suffix (>= 2.0.2, < 4.0)
18+
cms_scanner (0.5.2)
19+
nokogiri (~> 1.10.0)
20+
opt_parse_validator (~> 1.7.3)
21+
public_suffix (>= 3.0, < 3.2)
22+
ruby-progressbar (~> 1.10.0)
23+
typhoeus (~> 1.3.0)
24+
xmlrpc (~> 0.3)
25+
yajl-ruby (~> 1.4.1)
26+
concurrent-ruby (1.1.5)
27+
domain_name (0.5.20180417)
28+
unf (>= 0.0.5, < 1.0.0)
29+
ethon (0.12.0)
30+
ffi (>= 1.3.0)
31+
ffi (1.11.1)
32+
ffi (1.11.1-x64-mingw32)
33+
http-cookie (1.0.3)
34+
domain_name (~> 0.5)
35+
i18n (1.6.0)
36+
concurrent-ruby (~> 1.0)
37+
mime-types (3.2.2)
38+
mime-types-data (~> 3.2015)
39+
mime-types-data (3.2019.0331)
40+
mini_portile2 (2.4.0)
41+
minitest (5.11.3)
42+
mustermann (1.0.3)
43+
netrc (0.11.0)
44+
nokogiri (1.10.3)
45+
mini_portile2 (~> 2.4.0)
46+
nokogiri (1.10.3-x64-mingw32)
47+
mini_portile2 (~> 2.4.0)
48+
opt_parse_validator (1.7.3)
49+
activesupport (>= 4.2, < 5.3.0)
50+
addressable (>= 2.5, < 2.7)
51+
public_suffix (3.1.0)
52+
rack (2.0.7)
53+
rack-protection (2.0.5)
54+
rack
55+
rest-client (2.0.2)
56+
http-cookie (>= 1.0.2, < 2.0)
57+
mime-types (>= 1.16, < 4.0)
58+
netrc (~> 0.8)
59+
rest-client (2.0.2-x64-mingw32)
60+
ffi (~> 1.9)
61+
http-cookie (>= 1.0.2, < 2.0)
62+
mime-types (>= 1.16, < 4.0)
63+
netrc (~> 0.8)
64+
ruby-progressbar (1.10.1)
65+
sinatra (2.0.5)
66+
mustermann (~> 1.0)
67+
rack (~> 2.0)
68+
rack-protection (= 2.0.5)
69+
tilt (~> 2.0)
70+
thread_safe (0.3.6)
71+
tilt (2.0.9)
72+
typhoeus (1.3.1)
73+
ethon (>= 0.9.0)
74+
tzinfo (1.2.5)
75+
thread_safe (~> 0.1)
76+
unf (0.1.4)
77+
unf_ext
78+
unf_ext (0.0.7.6)
79+
wpscan (3.5.4)
80+
cms_scanner (~> 0.5.1)
81+
xmlrpc (0.3.0)
82+
yajl-ruby (1.4.1)
83+
84+
PLATFORMS
85+
ruby
86+
x64-mingw32
87+
88+
DEPENDENCIES
89+
rest-client
90+
ruby-scanner-scaffolding!
91+
sinatra
92+
wpscan (= 3.5.4)
93+
94+
BUNDLED WITH
95+
2.0.1

‎README.md‎

Lines changed: 98 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,99 @@
1-
# scanner-cms-wpscan
1+
# About
2+
23
This repository contains a self contained µService utilizing the WPScan scanner for the secureCodeBox project.
4+
5+
Further Documentation:
6+
7+
- [Project Description][scb-project]
8+
- [Developer Guide][scb-developer-guide]
9+
- [User Guide][scb-user-guide]
10+
11+
## Configuration Options
12+
13+
To configure this service specify the following environment variables:
14+
15+
| Environment Variable | Value Example |
16+
| -------------------------- | ------------- |
17+
| ENGINE_ADDRESS | http://engine |
18+
| ENGINE_BASIC_AUTH_USER | username |
19+
| ENGINE_BASIC_AUTH_PASSWORD | 123456 |
20+
21+
### Local setup
22+
23+
1. Clone the repository
24+
2. You might need to install some dependencies `gem install sinatra rest-client`
25+
3. Run locally `ruby src/main.rb`
26+
27+
### Test
28+
29+
To run the testsuite run:
30+
31+
`rake test`
32+
33+
## WpScan Parameters
34+
35+
To hand over supported parameters through api usage, you can set following attributes:
36+
37+
```json
38+
[
39+
{
40+
"name": "some Name",
41+
"context": "some Context",
42+
"target": {
43+
"name": "targetName",
44+
"location": "http://your-target.com/",
45+
"attributes": {
46+
"WP_STEALTHY": "true",
47+
"WP_ENUMERATE": "[Options]",
48+
"WP_MAX_DURATION": "[Seconds]",
49+
"WP_THROTTLE": "[Milliseconds]",
50+
"WP_REQUEST_TIMEOUT": "[Seconds]",
51+
"WP_DETECTION_MODE": "[Options]",
52+
"WP_USER_AGENT": "[userAgent]",
53+
"WP_HEADERS": "[headers]"
54+
}
55+
}
56+
}
57+
]
58+
```
59+
60+
Options for enumerate attribute:
61+
62+
```txt
63+
Enumeration Process
64+
Available Choices:
65+
vp | Vulnerable plugins
66+
ap | All plugins
67+
p | Plugins
68+
vt | Vulnerable themes
69+
at | All themes
70+
t | Themes
71+
tt | Timthumbs
72+
cb | Config backups
73+
dbe | Db exports
74+
u | User IDs range. e.g: u1-5
75+
Range separator to use: '-'
76+
Value if no argument supplied: 1-10
77+
m | Media IDs range. e.g m1-15
78+
Note: Permalink setting must be set to "Plain" for those to be detected
79+
Range separator to use: '-'
80+
Value if no argument supplied: 1-100
81+
82+
Separator to use between the values: ','
83+
Default: All Plugins, Config Backups
84+
Value if no argument supplied: vp,vt,tt,cb,dbe,u,m
85+
Incompatible choices (only one of each group/s can be used):
86+
- vp, ap, p
87+
- vt, at, t
88+
```
89+
90+
## Build with docker
91+
92+
To build the docker container run:
93+
94+
`docker build -t IMAGE_NAME:LABEL .`
95+
96+
[scb-project]: https://github.com/secureCodeBox/secureCodeBox
97+
[scb-developer-guide]: https://github.com/secureCodeBox/secureCodeBox/blob/develop/docs/developer-guide/README.md
98+
[scb-developer-guidelines]: https://github.com/secureCodeBox/secureCodeBox/blob/develop/docs/developer-guide/README.md#guidelines
99+
[scb-user-guide]: https://github.com/secureCodeBox/secureCodeBox/tree/develop/docs/user-guide

‎Rakefile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
require 'rake/testtask'
2+
3+
Rake::TestTask.new do |t|
4+
t.libs << "test"
5+
t.test_files = FileList['tests/*test.rb']
6+
t.verbose = true
7+
end

‎src/main.rb‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
require 'sinatra'
2+
require 'json'
3+
require 'bundler'
4+
Bundler.setup(:default)
5+
require 'ruby-scanner-scaffolding'
6+
require 'ruby-scanner-scaffolding/healthcheck'
7+
require_relative "./wordpress_worker"
8+
9+
set :port, 8080
10+
set :bind, '0.0.0.0'
11+
set :environment, :production
12+
13+
client = WordpressWorker.new(
14+
'http://localhost:8080',
15+
'wordpress_webserverscan',
16+
['PROCESS_TARGETS']
17+
)
18+
19+
healthcheckClient = Healthcheck.new
20+
21+
get '/status' do
22+
status 500
23+
if client.healthy?
24+
status 200
25+
end
26+
content_type :json
27+
healthcheckClient.check(client)
28+
end
29+

‎src/wordpress_configuration.rb‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
def is_set(val)
2+
if val != ''
3+
elsif val.is_a?(Array)
4+
val.length != 0
5+
end
6+
end
7+
8+
class WordpressConfiguration
9+
attr_accessor :job_id
10+
attr_accessor :wordpress_scanner_target
11+
attr_accessor :wordpress_configuration
12+
13+
def self.from_target(job_id, target)
14+
config = WordpressConfiguration.new
15+
16+
enumerate = []
17+
target.dig('attributes', 'WP_ENUMERATE').each { |_, flag| enumerate << flag unless flag.nil? } unless !target.dig('attributes', 'WP_ENUMERATE')
18+
19+
config.job_id = job_id
20+
config.wordpress_scanner_target = target.dig('location')
21+
config.wordpress_configuration = ""
22+
config.wordpress_configuration += '--stealthy ' if target.dig('attributes', 'WP_STEALTHY')
23+
config.wordpress_configuration += "--enumerate #{enumerate.join(",")} " unless enumerate.empty?
24+
config.wordpress_configuration += "--max-scan-duration #{target.dig('attributes', 'WP_MAX_DURATION')} " unless !target.dig('attributes', 'WP_MAX_DURATION')
25+
config.wordpress_configuration += "--throttle #{target.dig('attributes', 'WP_THROTTLE')} " unless !target.dig('attributes', 'WP_THROTTLE')
26+
config.wordpress_configuration += "--request-timeout #{target.dig('attributes', 'WP_REQUEST_TIMEOUT')} " unless !target.dig('attributes', 'WP_REQUEST_TIMEOUT')
27+
config.wordpress_configuration += "--detection-mode #{target.dig('attributes', 'WP_DETECTION_MODE')} " unless !target.dig('attributes', 'WP_DETECTION_MODE')
28+
config.wordpress_configuration += "--ua #{target.dig('attributes', 'WP_USER_AGENT')} " unless !target.dig('attributes', 'WP_USER_AGENT')
29+
config.wordpress_configuration += "--headers #{target.dig('attributes', 'WP_HEADERS')} " unless !target.dig('attributes', 'WP_HEADERS')
30+
31+
32+
config
33+
end
34+
end

0 commit comments

Comments
 (0)