-
Notifications
You must be signed in to change notification settings - Fork 179
Description
🚓 New Scanner implementation request
Is your feature request related to a problem
As a secureCodeBox user I would like to use the secureCodeBox to check my external attack surface. Especially CMS systems, like Joomla, are common systems that may introduce new vulnerabilities on a regular basis.
Describe the solution you'd like
Since the secureCodeBox already supports the WordPress scanner WPScan and Typo3 scanner Typo3Scan, it would be great to also add at least one Joomla scanner.
The following are good candidates:
https://github.com/OWASP/joomscan : OWASP JoomScan Project: Advanced Joomla Scans
https://github.com/Tuhinshubhra/CMSeeK : Similar detection level. Results are more easily parsable (json format)
Describe alternatives you've considered
Additional context
https://www.infosecmatter.com/cms-vulnerability-scanners-for-wordpress-joomla-drupal-moodle-typo3/
Steps to implement a new scanner
Hint: A general guide how to implement a new SCB scanner is documented here
- Create a new folder with the name of the scanner here
- Add a
README.gotmpland give a brief overview of the scanner and its configuration options. - Add a HelmChart and document all configuration options.
- Implement a new scanner specific
scan-type.yaml - Implement a new scanner specific
parse-definition.yaml - Add (optional) some
cascading-rules.yamllike documented here - Add (optional) a
Dockerfilefor the scanner if there is no existing one publicly available on dockerHub - Use the parser-SDK to implement a new findings parser (currently based on NodeJS)
- Add unit tests with at minimum 80% test coverage
- Add some example
scan.yamlandfinding.yamlfiles in the example folder - Implement a new integration or E2E test for the hook here