Commit Graph

55 Commits

Author SHA1 Message Date
danielsagi
259f707ecd Refactor And Major Bug Fixes in Version and CVE hunting (#162)
* changed version hunting to be on a a new version disclosure vulnerability

* fixed version publish

* added logging and fixed typo

* changed whole way of comparing versions in cve hunter

* changed K8sVersionDisclosure vulnerability to one core vulnerability, that takes an endpoint. changed all usage

* added tests

* merged kubectl cve hunting with apiserver hunting. and simplified the code of apiserver cve hunting

* fixed tests to new names

* changed name of module to cves.py

* drastically improved the cve vulnerble detection utility function. now works with all types of versioning methods

* added packaging in requirementes.txt

* added another test, and improved logic on cve comparison for more complicated versions

* changed CveHunter to subscribe_once, to prevent duplicates duplicates

* fixed tests for new improvements

* removed unnecessary ternary on doc

* removed unnecessary join split

* improved compare function, made it util

* improved cve checking to use mapping
2019-08-27 08:48:47 +01:00
danielsagi
f5b72d44b5 New Core Feature: Subscribe Once (#168)
* added a subscribe_once decorator

* created tests for core functionality, for now, subscibe and subscribe once
2019-08-13 15:44:41 +01:00
Tom Davidson
e3af42cbce Separate report "sending" into modules (#156)
* moved report output into dispatchers, stdout by default with config option of http(s)

* notes in arg config on how to configure http dispatcher

* removed some debug log visibility indicators

* missing import

* env vars more descriptive: KUBEHUNTER_HTTP_DISPATCH_METHOD and KUBEHUNTER_HTTP_DISPATCH_URL

* optimisation: delayed instantiation of the dispatcher until after selection to avoid instantiating unnecessarily

* refactor: config selection as per reporter selection

* bugfix: fall-back to default required if unknown reporter or dispatcher specified

* swapping urllib3 for requests

* corrected visibility levels for logging

* moving dispatchers into a file in reporters rather than it's own place to fit with theme and support dynamic module loading
2019-08-12 13:28:31 +03:00
danielsagi
5185f28fff Added event filtering mechanism (#134)
* added event filtering mechanism, as well as a detailed explanation in src/README

* changed filter search to run only once for each event, also now returning None to indicate keeping of event

* expanded explanation of filtering in readme

* Tiny typo

* made changes for better readability, also filter should now return  None to indicate throwing of event

* changed apply filters loop to be simple and running on each publish.

* changed README

* added reassuring of parent event after filters

* moved event filtering to another function, now supporting trhoeing of event mid loop

* added note in README about event.previous

* Tiny text corrections

* More accurate comment

"Throwing an event" can actually mean triggering it (which is different from "throwing it _away_"). But I went for "discarded" here to be completely clear

* Remove superflous space that had crept in
2019-07-03 11:52:42 +01:00
danielsagi
b2d2f5a01a New kubectl CVE hunter, detecting CVE-2019-11246 and CVE_2019_1002101 (#141)
* added a new hunter for CVE-2019-11246

* added KubectlClient component

* overriden location function on event to display a 'local machine' location

* added clarification about kubectl version --client operation

* Fix tiny typo

It reads better without the comma

* removed unnecessary debug message

* added CVE hunter for kubectl to allow more CVE checking.
2019-06-27 09:51:18 +01:00
danielsagi
f360c541ff Minor improve of task counting of queue (#139)
* changed way of task handler to be more safe. also added info about cases when one task is hanging

* removed queue_lock
2019-06-27 09:36:31 +01:00
Daniel Sagi
50ea9a2405 added more detailed explanation about exceptions in debug 2019-06-12 17:43:16 +03:00
nshauli
f5c54428f8 Add hunter name to each event and to each vulnrability in json and yaml report 2019-06-03 16:17:33 +03:00
nshauli
ac7027dab6 1. Change hunter statistics to count vulnerabilities only.
2. Add --statistics flag support.
3. Show hunter statistics only if --statistics was set.
4. Few infrastructure improvements.
2019-05-20 21:32:52 +03:00
nshauli
b4df6b5298 Add support for hunters list as part of the reports.
Each reported hunter includes name, description and number of events.
Add severity field to each vulnerability report.
2019-05-14 12:44:30 +03:00
Michael Cherny
1cd44832e6 Fixes #99 - pod local vulnerabilities are now reported as "Local to Pod" ( <pod name> )
Event  can now implement 'location()' method that return string representing  events logical location.
In events chain, the 'newest' event available location method will be used. This is because we compose (chain) events.
Core changed to support it.
Added 'location()' method to relevant event classes.
Reports are now using vulnerability.location() to retrieve location.
2019-03-07 14:45:26 +02:00
Weston Steimel
45d32be212 support for python3
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
2019-03-04 21:37:59 +00:00
Idan Revivo
1d258f7447 added support for new Vulnerability CVE-2019-1002100 2019-03-03 18:57:12 +02:00
Liz Rice
e2b5f0f5a0 Remove deprecation warning 2019-02-20 17:39:33 +00:00
Ori Agmon
cb0164edd1 Shallow detection cve 2018 1002105 (#65)
* added the CVE hunter, haven't checked the hunter yet

* fixed illegal name for import file

* Completed & Tested
2018-12-05 23:30:45 +02:00
Liz Rice
1171c8ae20 Merge branch 'master' into access-secrets-hunter 2018-11-06 09:08:14 +00:00
Liz Rice
df5d0bc3f6 Merge pull request #58 from aquasecurity/solve-multi-threading-bug
Solve multi threading bug
2018-10-22 13:34:26 +01:00
oriagmon
951efab5e0 Fixed PR comments. 2018-10-22 11:39:53 +03:00
Ori Agmon
fc0960d3bb Merge branch 'master' into access-secrets-hunter 2018-10-21 12:04:59 +03:00
oriagmon
812edafe80 Solved spacing conflict 2018-10-21 11:51:44 +03:00
oriagmon
3b0d2233fd Solved spacing conflict 2018-10-21 11:50:42 +03:00
oriagmon
a7e4ebf369 Solved spacing conflict 2018-10-21 11:47:15 +03:00
oriagmon
54da07a73e Cleaned this branch to contain only updated secrets branch without locking 2018-10-21 11:23:30 +03:00
oriagmon
76692a36d7 Finished with the left of the PR comments. 2018-10-21 10:53:50 +03:00
oriagmon
7e324c5374 Fixed safe to change PR comments. the next fixes of these PR would need to be tested 2018-10-21 10:47:48 +03:00
Liz Rice
1eb422c0a6 Merge pull request #52 from aquasecurity/checkEtcdHunter
Etcd hunter
2018-10-17 18:34:33 +01:00
oriagmon
6602821a80 DONE 2018-10-17 20:21:27 +03:00
oriagmon
a109dd956b found another variable I think should be locked 2018-10-17 17:54:11 +03:00
oriagmon
26f3878f7c Using stricter locking "policy" 2018-10-17 15:28:18 +03:00
oriagmon
655467c27a Solved hidden exception that stopped program normal run. 2018-10-17 12:53:31 +03:00
oriagmon
87232a12cd Fixed PR: Used the same lock for each variable & changed locks names 2018-10-17 12:36:04 +03:00
oriagmon
a8762a4ada Fixed PR: Used the same lock for each variable & changed locks names 2018-10-17 11:32:50 +03:00
oriagmon
1b18825b5e Merge branch 'solve-multi-threading-bug' into access-secrets-hunter 2018-10-16 17:16:42 +03:00
oriagmon
086a403559 locked variables 2018-10-16 17:03:57 +03:00
oriagmon
8462eba1b1 Intending 2018-10-16 16:53:57 +03:00
oriagmon
229347e9fa Attempting to solve the threading bug, I will do more checking to be sure its gone 2018-10-16 16:53:07 +03:00
ori.agmon
bff5ce7558 Had to remove the Azure component form the hunting/aks since it made a circular dependency bug! 2018-10-14 15:10:14 +03:00
ori.agmon
b5117fb315 Had to remove the Azure component form the hunting/aks since it made a circular dependency bug! 2018-10-14 14:51:15 +03:00
ori.agmon
19c10fd8e9 Fixed the PR comments :-) 2018-10-08 17:18:19 +03:00
ori.agmon
7201f5e236 Solved some exception bugs & did some refactoring to code & Added event & splited active & passive hunter 2018-10-02 18:55:50 +03:00
daniel_sagi
71c14fbdf8 added list option, as well as added description for all hunters 2018-08-08 15:57:43 +03:00
daniel_sagi
31d7c1e754 sperated default report (tables and logging) from the the report being sent to aqua, to seperate modules. also added two core events: HuntStarted and HuntFinished. for reporters to listen to
Also changed default of tables for prinring evidence
2018-07-17 15:45:07 +03:00
daniel_sagi
a89f8d1f29 added categories for vulnerabilities. From now on, all vulnerabilities should be classified with a category 2018-07-15 13:14:48 +03:00
daniel_sagi
94790be334 added execption handling wraping on all hooks on execution 2018-07-15 13:12:48 +03:00
daniel_sagi
05bea207fd bug fix: default secure value for services changed from False to True 2018-07-04 12:36:41 +03:00
daniel_sagi
8c6712f378 1. Changed report methods and renamed "log" module to "", added another report generation in a new json format
2. started to add the --token option to send the finished report.
3. changed a bit of kubelet vulnerability output architecture to match out conventions.
4. added healthz check on kubelets
2018-06-20 12:09:40 +03:00
daniel_sagi
2b690056b0 Fixed type in privileged, also moved Components to core.types 2018-06-19 11:07:18 +03:00
daniel_sagi
f3b9b5200f added requirements.txt 2018-06-12 16:55:22 +03:00
daniel_sagi
73a4e83781 Added checks on api responses before json.loads, added a quick scanning option, to scan part of the subnet 2018-06-12 14:30:28 +03:00
daniel_sagi
c52e684272 removed passing of active attribute to results printing 2018-06-12 13:16:35 +03:00