mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
.
This commit is contained in:
Toby
@@ -0,0 +1,411 @@
|
||||
---
|
||||
name: vulnerability-scanning
|
||||
description: Scan systems and dependencies for CVEs and security vulnerabilities. Use tools like Nessus, OpenVAS, and Qualys to identify and prioritize vulnerabilities. Use when performing security assessments, compliance scanning, or vulnerability management.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Vulnerability Scanning
|
||||
|
||||
Identify and prioritize security vulnerabilities across infrastructure and applications.
|
||||
|
||||
## When to Use This Skill
|
||||
|
||||
Use this skill when:
|
||||
- Performing security assessments
|
||||
- Implementing vulnerability management programs
|
||||
- Meeting compliance requirements
|
||||
- Triaging and prioritizing remediation
|
||||
- Scanning infrastructure for known CVEs
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Access to scanning tools
|
||||
- Network access to targets
|
||||
- Appropriate authorization
|
||||
|
||||
## Vulnerability Scanning Tools
|
||||
|
||||
| Tool | Type | Best For |
|
||||
|------|------|----------|
|
||||
| Nessus | Commercial | Enterprise scanning |
|
||||
| OpenVAS | Open Source | Free alternative |
|
||||
| Qualys | Cloud SaaS | Large scale |
|
||||
| Nexpose/InsightVM | Commercial | Asset management |
|
||||
| Nuclei | Open Source | Template-based |
|
||||
|
||||
## OpenVAS Setup
|
||||
|
||||
### Docker Deployment
|
||||
|
||||
```bash
|
||||
# Run OpenVAS container
|
||||
docker run -d --name openvas \
|
||||
-p 443:443 \
|
||||
-v openvas-data:/data \
|
||||
greenbone/openvas-scanner
|
||||
|
||||
# Access web UI at https://localhost
|
||||
# Default credentials: admin/admin
|
||||
```
|
||||
|
||||
### Scanning Commands
|
||||
|
||||
```bash
|
||||
# Create target
|
||||
omp -u admin -w admin --xml='<create_target>
|
||||
<name>Web Servers</name>
|
||||
<hosts>192.168.1.0/24</hosts>
|
||||
</create_target>'
|
||||
|
||||
# Create task
|
||||
omp -u admin -w admin --xml='<create_task>
|
||||
<name>Weekly Scan</name>
|
||||
<target id="target-uuid"/>
|
||||
<config id="daba56c8-73ec-11df-a475-002264764cea"/>
|
||||
</create_task>'
|
||||
|
||||
# Start task
|
||||
omp -u admin -w admin --xml='<start_task task_id="task-uuid"/>'
|
||||
|
||||
# Get results
|
||||
omp -u admin -w admin --xml='<get_results task_id="task-uuid"/>'
|
||||
```
|
||||
|
||||
## Nessus
|
||||
|
||||
### API Usage
|
||||
|
||||
```python
|
||||
import requests
|
||||
|
||||
class NessusScanner:
|
||||
def __init__(self, url, access_key, secret_key):
|
||||
self.url = url
|
||||
self.headers = {
|
||||
'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}',
|
||||
'Content-Type': 'application/json'
|
||||
}
|
||||
|
||||
def create_scan(self, name, targets, template='basic'):
|
||||
"""Create a new scan."""
|
||||
templates = self.get('/editor/scan/templates')
|
||||
template_uuid = next(
|
||||
t['uuid'] for t in templates['templates']
|
||||
if t['name'] == template
|
||||
)
|
||||
|
||||
payload = {
|
||||
'uuid': template_uuid,
|
||||
'settings': {
|
||||
'name': name,
|
||||
'text_targets': targets,
|
||||
'enabled': True
|
||||
}
|
||||
}
|
||||
return self.post('/scans', payload)
|
||||
|
||||
def launch_scan(self, scan_id):
|
||||
"""Start a scan."""
|
||||
return self.post(f'/scans/{scan_id}/launch')
|
||||
|
||||
def get_results(self, scan_id):
|
||||
"""Get scan results."""
|
||||
return self.get(f'/scans/{scan_id}')
|
||||
|
||||
def export_report(self, scan_id, format='pdf'):
|
||||
"""Export scan report."""
|
||||
payload = {'format': format}
|
||||
response = self.post(f'/scans/{scan_id}/export', payload)
|
||||
file_id = response['file']
|
||||
|
||||
# Wait for export
|
||||
while True:
|
||||
status = self.get(f'/scans/{scan_id}/export/{file_id}/status')
|
||||
if status['status'] == 'ready':
|
||||
break
|
||||
time.sleep(5)
|
||||
|
||||
return self.get(f'/scans/{scan_id}/export/{file_id}/download')
|
||||
|
||||
def get(self, path):
|
||||
response = requests.get(f'{self.url}{path}', headers=self.headers, verify=False)
|
||||
return response.json()
|
||||
|
||||
def post(self, path, data=None):
|
||||
response = requests.post(f'{self.url}{path}', json=data, headers=self.headers, verify=False)
|
||||
return response.json()
|
||||
|
||||
# Usage
|
||||
scanner = NessusScanner('https://nessus:8834', 'access-key', 'secret-key')
|
||||
scan = scanner.create_scan('Weekly Infrastructure Scan', '10.0.0.0/24')
|
||||
scanner.launch_scan(scan['scan']['id'])
|
||||
```
|
||||
|
||||
## Nuclei
|
||||
|
||||
### Installation
|
||||
|
||||
```bash
|
||||
# Install nuclei
|
||||
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
|
||||
|
||||
# Or download binary
|
||||
wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip
|
||||
unzip nuclei_linux_amd64.zip
|
||||
```
|
||||
|
||||
### Basic Scanning
|
||||
|
||||
```bash
|
||||
# Update templates
|
||||
nuclei -update-templates
|
||||
|
||||
# Scan single target
|
||||
nuclei -u https://example.com
|
||||
|
||||
# Scan multiple targets
|
||||
nuclei -l targets.txt
|
||||
|
||||
# Scan with specific templates
|
||||
nuclei -u https://example.com -t cves/
|
||||
nuclei -u https://example.com -t vulnerabilities/
|
||||
|
||||
# Scan with severity filter
|
||||
nuclei -u https://example.com -s critical,high
|
||||
|
||||
# Output formats
|
||||
nuclei -u https://example.com -o results.txt
|
||||
nuclei -u https://example.com -json -o results.json
|
||||
```
|
||||
|
||||
### Custom Templates
|
||||
|
||||
```yaml
|
||||
# custom-check.yaml
|
||||
id: custom-admin-panel
|
||||
|
||||
info:
|
||||
name: Admin Panel Detection
|
||||
author: security-team
|
||||
severity: info
|
||||
tags: recon,panel
|
||||
|
||||
requests:
|
||||
- method: GET
|
||||
path:
|
||||
- "{{BaseURL}}/admin"
|
||||
- "{{BaseURL}}/administrator"
|
||||
- "{{BaseURL}}/wp-admin"
|
||||
|
||||
matchers-condition: or
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "admin"
|
||||
- "login"
|
||||
condition: and
|
||||
|
||||
- type: status
|
||||
status:
|
||||
- 200
|
||||
- 301
|
||||
- 302
|
||||
```
|
||||
|
||||
## CVSS Scoring
|
||||
|
||||
### Severity Levels
|
||||
|
||||
| Score | Rating | Response Time |
|
||||
|-------|--------|---------------|
|
||||
| 9.0-10.0 | Critical | 24 hours |
|
||||
| 7.0-8.9 | High | 7 days |
|
||||
| 4.0-6.9 | Medium | 30 days |
|
||||
| 0.1-3.9 | Low | 90 days |
|
||||
|
||||
### Prioritization Factors
|
||||
|
||||
```yaml
|
||||
prioritization_criteria:
|
||||
critical_factors:
|
||||
- Internet-facing systems
|
||||
- Systems with sensitive data
|
||||
- Active exploitation in the wild
|
||||
- Authentication bypass
|
||||
|
||||
high_factors:
|
||||
- Remote code execution
|
||||
- Privilege escalation
|
||||
- Data exfiltration risk
|
||||
|
||||
context_adjustments:
|
||||
- Compensating controls in place (-1)
|
||||
- No direct exposure (-1)
|
||||
- Critical business system (+1)
|
||||
- Compliance requirement (+1)
|
||||
```
|
||||
|
||||
## Vulnerability Management Process
|
||||
|
||||
### Workflow
|
||||
|
||||
```yaml
|
||||
vulnerability_workflow:
|
||||
discovery:
|
||||
- Run scheduled scans
|
||||
- Import third-party findings
|
||||
- Correlate with asset inventory
|
||||
|
||||
analysis:
|
||||
- Validate findings
|
||||
- Remove false positives
|
||||
- Assess business impact
|
||||
- Prioritize by risk score
|
||||
|
||||
remediation:
|
||||
- Assign to owners
|
||||
- Track SLA compliance
|
||||
- Verify fixes
|
||||
- Document exceptions
|
||||
|
||||
reporting:
|
||||
- Executive summaries
|
||||
- Technical details
|
||||
- Trend analysis
|
||||
- Compliance metrics
|
||||
```
|
||||
|
||||
### Tracking Template
|
||||
|
||||
```markdown
|
||||
## Vulnerability Ticket
|
||||
|
||||
**ID:** VULN-2024-001
|
||||
**CVE:** CVE-2024-12345
|
||||
**CVSS:** 9.8 (Critical)
|
||||
**Affected System:** web-server-01
|
||||
|
||||
### Description
|
||||
Remote code execution vulnerability in Apache Struts.
|
||||
|
||||
### Impact
|
||||
Attacker can execute arbitrary code on the server.
|
||||
|
||||
### Remediation
|
||||
1. Update Apache Struts to version 2.5.33
|
||||
2. Apply WAF rule as temporary mitigation
|
||||
|
||||
### Timeline
|
||||
- Discovered: 2024-01-15
|
||||
- SLA Due: 2024-01-16
|
||||
- Remediated: 2024-01-15
|
||||
|
||||
### Evidence
|
||||
- Scan report: [link]
|
||||
- Screenshot: [link]
|
||||
```
|
||||
|
||||
## CI/CD Integration
|
||||
|
||||
### GitHub Actions
|
||||
|
||||
```yaml
|
||||
name: Vulnerability Scan
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 2 * * *'
|
||||
push:
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
scan:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Run Nuclei
|
||||
uses: projectdiscovery/nuclei-action@main
|
||||
with:
|
||||
target: https://example.com
|
||||
templates: cves/
|
||||
output: nuclei-results.txt
|
||||
|
||||
- name: Check for critical findings
|
||||
run: |
|
||||
if grep -q "critical" nuclei-results.txt; then
|
||||
echo "Critical vulnerabilities found!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Upload results
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: vulnerability-report
|
||||
path: nuclei-results.txt
|
||||
```
|
||||
|
||||
## Compliance Scanning
|
||||
|
||||
### CIS Benchmark Scan
|
||||
|
||||
```bash
|
||||
# Using OpenSCAP
|
||||
oscap xccdf eval \
|
||||
--profile xccdf_org.ssgproject.content_profile_cis \
|
||||
--results results.xml \
|
||||
--report report.html \
|
||||
/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
|
||||
```
|
||||
|
||||
### PCI DSS Scanning
|
||||
|
||||
```yaml
|
||||
pci_scan_requirements:
|
||||
quarterly:
|
||||
- External vulnerability scan (ASV)
|
||||
- Internal vulnerability scan
|
||||
|
||||
after_changes:
|
||||
- Significant infrastructure changes
|
||||
- New system deployments
|
||||
|
||||
passing_criteria:
|
||||
- No vulnerabilities rated 4.0+ (CVSS)
|
||||
- False positives documented
|
||||
- Scan completed within 90 days
|
||||
```
|
||||
|
||||
## Common Issues
|
||||
|
||||
### Issue: False Positives
|
||||
**Problem**: Scanner reports non-existent vulnerabilities
|
||||
**Solution**: Validate manually, tune scanner, maintain exception list
|
||||
|
||||
### Issue: Incomplete Coverage
|
||||
**Problem**: Not all assets scanned
|
||||
**Solution**: Update asset inventory, verify credentials, check network access
|
||||
|
||||
### Issue: Scan Impact
|
||||
**Problem**: Scans affecting production systems
|
||||
**Solution**: Schedule during maintenance windows, use authenticated scans
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Maintain accurate asset inventory
|
||||
- Schedule regular scan cadence
|
||||
- Validate findings before remediation
|
||||
- Track metrics (MTTR, aging)
|
||||
- Integrate with ticketing systems
|
||||
- Document exceptions properly
|
||||
- Use risk-based prioritization
|
||||
- Automate where possible
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [sast-scanning](../sast-scanning/) - Code analysis
|
||||
- [container-scanning](../container-scanning/) - Container security
|
||||
- [cis-benchmarks](../../hardening/cis-benchmarks/) - Compliance benchmarks
|
||||
@@ -0,0 +1,94 @@
|
||||
# GitHub Actions Vulnerability Scanning Workflow
|
||||
# Add to .github/workflows/security-scan.yaml
|
||||
|
||||
name: Security Scan
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main, develop]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
schedule:
|
||||
# Run daily at midnight
|
||||
- cron: '0 0 * * *'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
security-events: write
|
||||
|
||||
jobs:
|
||||
trivy-scan:
|
||||
name: Trivy Vulnerability Scan
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Run Trivy vulnerability scanner (filesystem)
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
scan-type: 'fs'
|
||||
scan-ref: '.'
|
||||
format: 'sarif'
|
||||
output: 'trivy-fs-results.sarif'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
if: always()
|
||||
with:
|
||||
sarif_file: 'trivy-fs-results.sarif'
|
||||
|
||||
container-scan:
|
||||
name: Container Image Scan
|
||||
runs-on: ubuntu-latest
|
||||
if: github.event_name == 'push'
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Build image
|
||||
run: docker build -t myapp:${{ github.sha }} .
|
||||
|
||||
- name: Run Trivy vulnerability scanner (image)
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: 'myapp:${{ github.sha }}'
|
||||
format: 'sarif'
|
||||
output: 'trivy-image-results.sarif'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
ignore-unfixed: true
|
||||
|
||||
- name: Upload Trivy scan results
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
if: always()
|
||||
with:
|
||||
sarif_file: 'trivy-image-results.sarif'
|
||||
|
||||
dependency-review:
|
||||
name: Dependency Review
|
||||
runs-on: ubuntu-latest
|
||||
if: github.event_name == 'pull_request'
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Dependency Review
|
||||
uses: actions/dependency-review-action@v3
|
||||
with:
|
||||
fail-on-severity: high
|
||||
deny-licenses: GPL-3.0, AGPL-3.0
|
||||
|
||||
secrets-scan:
|
||||
name: Secret Detection
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Gitleaks scan
|
||||
uses: gitleaks/gitleaks-action@v2
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
@@ -0,0 +1,70 @@
|
||||
# Trivy Configuration
|
||||
# Place in project root or ~/.trivy.yaml
|
||||
|
||||
# Scan settings
|
||||
scan:
|
||||
# Scanners to use
|
||||
scanners:
|
||||
- vuln
|
||||
- secret
|
||||
- config
|
||||
|
||||
# Severity levels to report
|
||||
severity:
|
||||
- CRITICAL
|
||||
- HIGH
|
||||
- MEDIUM
|
||||
|
||||
# Vulnerability settings
|
||||
vulnerability:
|
||||
# Ignore unfixed vulnerabilities
|
||||
ignore-unfixed: true
|
||||
|
||||
# Vulnerability types
|
||||
type:
|
||||
- os
|
||||
- library
|
||||
|
||||
# Secret scanning settings
|
||||
secret:
|
||||
config: trivy-secret.yaml
|
||||
|
||||
# Misconfiguration settings
|
||||
misconfiguration:
|
||||
# Policy paths (custom OPA policies)
|
||||
policy:
|
||||
- ./policies
|
||||
|
||||
# Cache settings
|
||||
cache:
|
||||
# Cache directory
|
||||
dir: /tmp/trivy-cache
|
||||
|
||||
# Cache TTL in hours
|
||||
ttl: 24h
|
||||
|
||||
# Database settings
|
||||
db:
|
||||
# Repository for vulnerability database
|
||||
repository: ghcr.io/aquasecurity/trivy-db
|
||||
|
||||
# Output settings
|
||||
format: table
|
||||
output: ""
|
||||
|
||||
# Exit code when vulnerabilities found
|
||||
exit-code: 0
|
||||
|
||||
# Ignore specific files
|
||||
skip-files:
|
||||
- "**/*_test.go"
|
||||
- "**/test/**"
|
||||
|
||||
# Ignore specific directories
|
||||
skip-dirs:
|
||||
- node_modules
|
||||
- vendor
|
||||
- .git
|
||||
|
||||
# Custom ignore file
|
||||
ignorefile: .trivyignore.yaml
|
||||
@@ -0,0 +1,135 @@
|
||||
# Vulnerability Remediation Guide
|
||||
|
||||
## Triage Process
|
||||
|
||||
### 1. Assess Impact
|
||||
- Is the vulnerability exploitable in your context?
|
||||
- Is the vulnerable component reachable?
|
||||
- What's the potential business impact?
|
||||
|
||||
### 2. Prioritize
|
||||
```
|
||||
Priority Matrix:
|
||||
Exploitable
|
||||
Yes No
|
||||
Impact High P1-Critical P2-High
|
||||
Medium P2-High P3-Medium
|
||||
Low P3-Medium P4-Low
|
||||
```
|
||||
|
||||
### 3. Remediation Options
|
||||
|
||||
| Option | When to Use |
|
||||
|--------|-------------|
|
||||
| **Upgrade** | Fix available, no breaking changes |
|
||||
| **Patch** | Apply security patch |
|
||||
| **Workaround** | Mitigate until fix available |
|
||||
| **Accept** | Risk accepted with documentation |
|
||||
| **Remove** | Dependency not needed |
|
||||
|
||||
## Common Remediation Steps
|
||||
|
||||
### Container Base Images
|
||||
|
||||
```dockerfile
|
||||
# Before: Vulnerable base
|
||||
FROM ubuntu:20.04
|
||||
|
||||
# After: Updated base
|
||||
FROM ubuntu:22.04
|
||||
|
||||
# Better: Minimal base
|
||||
FROM gcr.io/distroless/base-debian12
|
||||
```
|
||||
|
||||
### JavaScript Dependencies
|
||||
|
||||
```bash
|
||||
# View outdated packages
|
||||
npm outdated
|
||||
|
||||
# Update specific package
|
||||
npm update lodash
|
||||
|
||||
# Update all (careful!)
|
||||
npm update
|
||||
|
||||
# Force resolution
|
||||
npm audit fix --force
|
||||
|
||||
# Check for updates
|
||||
npx npm-check-updates
|
||||
```
|
||||
|
||||
### Python Dependencies
|
||||
|
||||
```bash
|
||||
# Update specific package
|
||||
pip install --upgrade requests
|
||||
|
||||
# Update with constraints
|
||||
pip install 'requests>=2.28.0,<3.0.0'
|
||||
|
||||
# Using pip-tools
|
||||
pip-compile --upgrade requirements.in
|
||||
```
|
||||
|
||||
### Terraform Providers
|
||||
|
||||
```hcl
|
||||
# Pin to secure version
|
||||
terraform {
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0" # Update to latest minor
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## False Positive Handling
|
||||
|
||||
### Trivy Ignore
|
||||
```yaml
|
||||
# .trivyignore
|
||||
CVE-2022-12345 # Reason: Not exploitable in our context
|
||||
CVE-2022-67890 # Reason: Component not exposed
|
||||
```
|
||||
|
||||
### Grype Ignore
|
||||
```yaml
|
||||
# .grype.yaml
|
||||
ignore:
|
||||
- vulnerability: CVE-2022-12345
|
||||
reason: "Not applicable - component not used"
|
||||
```
|
||||
|
||||
## Documentation Template
|
||||
|
||||
```markdown
|
||||
## Vulnerability Assessment: CVE-XXXX-XXXXX
|
||||
|
||||
**Severity:** High (CVSS 7.5)
|
||||
**Component:** package-name v1.2.3
|
||||
**Status:** [Remediated/Accepted/Pending]
|
||||
|
||||
### Description
|
||||
Brief description of the vulnerability.
|
||||
|
||||
### Impact Assessment
|
||||
- Exploitability in our environment: [Yes/No/Partial]
|
||||
- Affected systems: [List systems]
|
||||
- Business impact: [Description]
|
||||
|
||||
### Remediation
|
||||
- Action taken: Upgraded to v1.2.4
|
||||
- Date: YYYY-MM-DD
|
||||
- Verified by: [Name]
|
||||
|
||||
### If Accepted
|
||||
- Reason for acceptance:
|
||||
- Compensating controls:
|
||||
- Review date:
|
||||
- Approved by:
|
||||
```
|
||||
@@ -0,0 +1,93 @@
|
||||
# Vulnerability Scanner Comparison
|
||||
|
||||
## Container Image Scanners
|
||||
|
||||
| Tool | License | Speed | Database | CI Integration |
|
||||
|------|---------|-------|----------|----------------|
|
||||
| **Trivy** | Apache 2.0 | Fast | NVD, Red Hat, etc. | Excellent |
|
||||
| **Grype** | Apache 2.0 | Fast | Anchore DB | Good |
|
||||
| **Clair** | Apache 2.0 | Medium | NVD, Alpine, etc. | Good |
|
||||
| **Snyk** | Commercial | Fast | Snyk DB | Excellent |
|
||||
| **Docker Scout** | Commercial | Fast | Docker DB | Native |
|
||||
|
||||
## Recommended: Trivy
|
||||
|
||||
### Installation
|
||||
```bash
|
||||
# Homebrew
|
||||
brew install trivy
|
||||
|
||||
# APT
|
||||
apt-get install trivy
|
||||
|
||||
# Docker
|
||||
docker run aquasec/trivy image nginx:latest
|
||||
```
|
||||
|
||||
### Basic Usage
|
||||
```bash
|
||||
# Scan image
|
||||
trivy image nginx:latest
|
||||
|
||||
# Scan with severity filter
|
||||
trivy image --severity HIGH,CRITICAL nginx:latest
|
||||
|
||||
# Scan and fail on vulnerabilities
|
||||
trivy image --exit-code 1 --severity CRITICAL nginx:latest
|
||||
|
||||
# JSON output
|
||||
trivy image -f json -o results.json nginx:latest
|
||||
|
||||
# Scan filesystem
|
||||
trivy fs /path/to/project
|
||||
|
||||
# Scan Kubernetes
|
||||
trivy k8s --report summary cluster
|
||||
```
|
||||
|
||||
### GitHub Actions
|
||||
```yaml
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: 'myapp:${{ github.sha }}'
|
||||
format: 'sarif'
|
||||
output: 'trivy-results.sarif'
|
||||
severity: 'CRITICAL,HIGH'
|
||||
|
||||
- name: Upload Trivy scan results
|
||||
uses: github/codeql-action/upload-sarif@v2
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
```
|
||||
|
||||
## Dependency Scanners
|
||||
|
||||
| Tool | Languages | License |
|
||||
|------|-----------|---------|
|
||||
| **npm audit** | JavaScript | Free |
|
||||
| **pip-audit** | Python | Free |
|
||||
| **bundle audit** | Ruby | Free |
|
||||
| **cargo audit** | Rust | Free |
|
||||
| **Snyk** | Multi | Commercial |
|
||||
| **Dependabot** | Multi | Free (GitHub) |
|
||||
| **OWASP Dependency-Check** | Multi | Apache 2.0 |
|
||||
|
||||
## Infrastructure as Code Scanners
|
||||
|
||||
| Tool | Targets | License |
|
||||
|------|---------|---------|
|
||||
| **tfsec** | Terraform | MIT |
|
||||
| **checkov** | TF, CloudFormation, K8s | Apache 2.0 |
|
||||
| **kics** | Multi IaC | Apache 2.0 |
|
||||
| **kubesec** | Kubernetes | Apache 2.0 |
|
||||
|
||||
## CVSS Score Reference
|
||||
|
||||
| Score | Severity |
|
||||
|-------|----------|
|
||||
| 0.0 | None |
|
||||
| 0.1-3.9 | Low |
|
||||
| 4.0-6.9 | Medium |
|
||||
| 7.0-8.9 | High |
|
||||
| 9.0-10.0 | Critical |
|
||||
@@ -0,0 +1,53 @@
|
||||
#!/bin/bash
|
||||
# Container Image Vulnerability Scanner
|
||||
# Usage: ./scan-images.sh <image> [--severity HIGH,CRITICAL] [--format json|table]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
IMAGE="${1:-}"
|
||||
SEVERITY="${2:-HIGH,CRITICAL}"
|
||||
FORMAT="${3:-table}"
|
||||
|
||||
if [ -z "$IMAGE" ]; then
|
||||
echo "Usage: $0 <image> [--severity HIGH,CRITICAL] [--format json|table]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "========================================="
|
||||
echo "Scanning Image: $IMAGE"
|
||||
echo "Severity Filter: $SEVERITY"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
# Check which scanner is available
|
||||
if command -v trivy &>/dev/null; then
|
||||
echo "Using Trivy scanner..."
|
||||
trivy image \
|
||||
--severity "$SEVERITY" \
|
||||
--format "$FORMAT" \
|
||||
--ignore-unfixed \
|
||||
"$IMAGE"
|
||||
|
||||
elif command -v grype &>/dev/null; then
|
||||
echo "Using Grype scanner..."
|
||||
grype "$IMAGE" \
|
||||
--only-fixed \
|
||||
--fail-on high \
|
||||
-o "$FORMAT"
|
||||
|
||||
elif command -v docker &>/dev/null && docker scout version &>/dev/null 2>&1; then
|
||||
echo "Using Docker Scout..."
|
||||
docker scout cves "$IMAGE" \
|
||||
--only-severity critical,high \
|
||||
--format "$FORMAT"
|
||||
|
||||
else
|
||||
echo "Error: No vulnerability scanner found."
|
||||
echo "Install one of: trivy, grype, or docker scout"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Scan complete"
|
||||
echo "========================================="
|
||||
@@ -0,0 +1,81 @@
|
||||
#!/bin/bash
|
||||
# Repository Vulnerability Scanner
|
||||
# Scans for vulnerabilities in dependencies and IaC
|
||||
# Usage: ./scan-repo.sh [directory] [--output report.json]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCAN_DIR="${1:-.}"
|
||||
OUTPUT="${2:-}"
|
||||
|
||||
echo "========================================="
|
||||
echo "Repository Security Scan"
|
||||
echo "Directory: $SCAN_DIR"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
ISSUES_FOUND=0
|
||||
|
||||
# Trivy filesystem scan
|
||||
if command -v trivy &>/dev/null; then
|
||||
echo "=== Trivy Filesystem Scan ==="
|
||||
trivy fs "$SCAN_DIR" \
|
||||
--severity HIGH,CRITICAL \
|
||||
--scanners vuln,secret,config \
|
||||
--ignore-unfixed \
|
||||
|| ISSUES_FOUND=1
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# Check for secrets with gitleaks
|
||||
if command -v gitleaks &>/dev/null; then
|
||||
echo "=== GitLeaks Secret Scan ==="
|
||||
gitleaks detect --source "$SCAN_DIR" --no-git || ISSUES_FOUND=1
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# Check Terraform with tfsec
|
||||
if command -v tfsec &>/dev/null && [ -d "$SCAN_DIR" ]; then
|
||||
if find "$SCAN_DIR" -name "*.tf" -print -quit | grep -q .; then
|
||||
echo "=== TFSec Terraform Scan ==="
|
||||
tfsec "$SCAN_DIR" --minimum-severity HIGH || ISSUES_FOUND=1
|
||||
echo ""
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check Kubernetes manifests with kubesec
|
||||
if command -v kubesec &>/dev/null; then
|
||||
for manifest in $(find "$SCAN_DIR" -name "*.yaml" -o -name "*.yml" 2>/dev/null | head -10); do
|
||||
if grep -q "kind:" "$manifest" 2>/dev/null; then
|
||||
echo "=== Kubesec: $manifest ==="
|
||||
kubesec scan "$manifest" 2>/dev/null || true
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# Python dependencies
|
||||
if [ -f "$SCAN_DIR/requirements.txt" ]; then
|
||||
if command -v pip-audit &>/dev/null; then
|
||||
echo "=== Python Dependency Audit ==="
|
||||
pip-audit -r "$SCAN_DIR/requirements.txt" || ISSUES_FOUND=1
|
||||
echo ""
|
||||
fi
|
||||
fi
|
||||
|
||||
# Node.js dependencies
|
||||
if [ -f "$SCAN_DIR/package.json" ]; then
|
||||
if command -v npm &>/dev/null; then
|
||||
echo "=== NPM Audit ==="
|
||||
(cd "$SCAN_DIR" && npm audit --audit-level=high 2>/dev/null) || ISSUES_FOUND=1
|
||||
echo ""
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "========================================="
|
||||
if [ $ISSUES_FOUND -eq 1 ]; then
|
||||
echo "⚠ Security issues found - review above"
|
||||
exit 1
|
||||
else
|
||||
echo "✓ No critical security issues found"
|
||||
fi
|
||||
echo "========================================="
|
||||
Reference in New Issue
Block a user