From f97e6aec396a773f972cad089bc07100fca0dacf Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Mon, 2 Dec 2019 16:54:11 +0100 Subject: [PATCH 01/11] Added ncrack process --- Dockerfile | 2 +- scb-engine/pom.xml | 6 + scb-scanprocesses/ncrack-process/pom.xml | 74 ++++++ .../scanprocess/ProcessInitConfiguration.java | 36 +++ .../src/main/resources/META-INF/processes.xml | 0 .../main/resources/bpmn/ncrack_process.bpmn | 196 +++++++++++++++ .../forms/default/approve-results.html | 124 ++++++++++ .../forms/default/configure-target.html | 128 ++++++++++ .../scanprocess/test/NcrackProcessTest.java | 226 ++++++++++++++++++ .../src/test/resources/camunda.cfg.xml | 14 ++ .../src/test/resources/logback-test.xml | 27 +++ scb-scanprocesses/pom.xml | 5 +- 12 files changed, 835 insertions(+), 3 deletions(-) create mode 100644 scb-scanprocesses/ncrack-process/pom.xml create mode 100644 scb-scanprocesses/ncrack-process/src/main/java/io/securecodebox/scanprocess/ProcessInitConfiguration.java create mode 100644 scb-scanprocesses/ncrack-process/src/main/resources/META-INF/processes.xml create mode 100644 scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn create mode 100644 scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html create mode 100644 scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html create mode 100644 scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java create mode 100644 scb-scanprocesses/ncrack-process/src/test/resources/camunda.cfg.xml create mode 100644 scb-scanprocesses/ncrack-process/src/test/resources/logback-test.xml diff --git a/Dockerfile b/Dockerfile index 52e2df74..9d362640 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,7 +23,7 @@ COPY --from=builder ./scb-scanprocesses/arachni-process/target/arachni-process-1 COPY --from=builder ./scb-scanprocesses/ssh-process/target/ssh-process-1.0-SNAPSHOT.jar /scb-engine/lib/ COPY --from=builder ./scb-scanprocesses/amass-process/target/amass-process-1.0-SNAPSHOT.jar /scb-engine/lib/ COPY --from=builder ./scb-scanprocesses/wordpress-process/target/wordpress-process-1.0-SNAPSHOT.jar /scb-engine/lib/ - +COPY --from=builder ./scb-scanprocesses/ncrack-process/target/ncrack-process-0.0.1-SNAPSHOT.jar /scb-engine/lib/ COPY --from=builder ./scb-persistenceproviders/elasticsearch-persistenceprovider/target/elasticsearch-persistenceprovider-0.0.1-SNAPSHOT-jar-with-dependencies.jar /scb-engine/lib/ COPY --from=builder ./scb-persistenceproviders/s3-persistenceprovider/target/s3-persistenceprovider-0.0.1-SNAPSHOT-jar-with-dependencies.jar /scb-engine/lib/ diff --git a/scb-engine/pom.xml b/scb-engine/pom.xml index f447b8db..58503bde 100644 --- a/scb-engine/pom.xml +++ b/scb-engine/pom.xml @@ -212,6 +212,12 @@ 1.0-SNAPSHOT runtime + + io.securecodebox.scanprocesses + ncrack-process + 0.0.1-SNAPSHOT + runtime + io.securecodebox.persistenceproviders elasticsearch-persistenceprovider diff --git a/scb-scanprocesses/ncrack-process/pom.xml b/scb-scanprocesses/ncrack-process/pom.xml new file mode 100644 index 00000000..460db104 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/pom.xml @@ -0,0 +1,74 @@ + + + + + 4.0.0 + + + io.securecodebox.scanprocesses + default-process-collection + 0.0.1-SNAPSHOT + + + io.securecodebox.scanprocesses + ncrack-process + 0.0.1-SNAPSHOT + + + + + io.securecodebox.core + sdk + ${project.parent.version} + + + + + com.h2database + h2 + + + org.camunda.bpm.springboot + camunda-bpm-spring-boot-starter-test + test + + + org.camunda.bpm.extension.mockito + camunda-bpm-mockito + test + + + org.camunda.bpm.extension + camunda-bpm-assert-scenario + test + + + org.camunda.bpm.extension + camunda-bpm-process-test-coverage + test + + + org.camunda.bpm.extension + camunda-bpm-assert + + + + diff --git a/scb-scanprocesses/ncrack-process/src/main/java/io/securecodebox/scanprocess/ProcessInitConfiguration.java b/scb-scanprocesses/ncrack-process/src/main/java/io/securecodebox/scanprocess/ProcessInitConfiguration.java new file mode 100644 index 00000000..033a2baa --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/main/java/io/securecodebox/scanprocess/ProcessInitConfiguration.java @@ -0,0 +1,36 @@ +/* + * + * SecureCodeBox (SCB) + * Copyright 2015-2018 iteratec GmbH + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * / + */ + +package io.securecodebox.scanprocess; + +import org.springframework.context.annotation.ComponentScan; +import org.springframework.context.annotation.Configuration; + +/** + * The secureCodeBox by default only scans for components in the package io.securecodebox.scanprocess. + *

+ * This configuration ensures that your defined package io.securecodebox.scanprocesses also gets scanned, please don't move or remove this configuration. + * + * @author Rüdiger Heins - iteratec GmbH + * @since 09.05.18 + */ +@ComponentScan("io.securecodebox.scanprocesses") +@Configuration +public class ProcessInitConfiguration { +} diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/META-INF/processes.xml b/scb-scanprocesses/ncrack-process/src/main/resources/META-INF/processes.xml new file mode 100644 index 00000000..e69de29b diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn new file mode 100644 index 00000000..ddb96373 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn @@ -0,0 +1,196 @@ + + + + + + + + + + + + + + SequenceFlow_TargetConfigured + + + + SequenceFlow_SummaryCreated + + + + + + + + SequenceFlow_ManualFinish + SequenceFlow_ResultReviewed + + + SequenceFlow_ResultReviewed + SequenceFlow_ResultApproved + SequenceFlow_ResultRejected + + + + + + SequenceFlow_ScanFinished + SequenceFlow_ManualFinish + SequenceFlow_AutomatedFinish + + + ${PROCESS_AUTOMATED == false} + + + ${PROCESS_AUTOMATED == true} + + + + SequenceFlow_TargetConfigured + SequenceFlow_ScanFinished + + + + + SequenceFlow_ResultApproved + SequenceFlow_1i44eck + SequenceFlow_AutomatedFinish + SequenceFlow_SummaryCreated + + + + + + + + SequenceFlow_ResultRejected + SequenceFlow_1i44eck + + + results in a generic format + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html new file mode 100644 index 00000000..d7326ad2 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html @@ -0,0 +1,124 @@ + + +

+ + +
+

scan results for "{{ target.name }}"

+ +
+
+
{{ scannerId }}
+
+
+
+
{{ target.location }}
+
+
+
+
{{ context }}
+
+
+
+ +
+ + + + + + + + + + + + + + + +
Host:Name:Category:Severity:Reference:
{{ result.location }}{{ result.name }}{{ result.category }} +
+ + + {{ result.severity }} + + + + + {{ result.severity }} + + + + + {{ result.severity }} + + + + + {{ result.severity }} + +
+ + 		{{ result.reference.id }} +
+
+
+ +
+
+

Approve Result

+ +
+ +
+ + +
+
+
diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html new file mode 100644 index 00000000..a030d16c --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html @@ -0,0 +1,128 @@ + + +

Please configure the Scan

+ +
+ + + +
+ +
+

Scan Target

+ + +
+
+
+ + +
+
+ + +
+
+ +
+
+ + +
+ + +
+ +
+ +
+
+ +
+
+
diff --git a/scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java b/scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java new file mode 100644 index 00000000..614d1485 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java @@ -0,0 +1,226 @@ +/* + * + * SecureCodeBox (SCB) + * Copyright 2015-2018 iteratec GmbH + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * / + */ + +package io.securecodebox.scanprocess.test; + +import io.securecodebox.constants.DefaultFields; +import io.securecodebox.scanprocess.delegate.SummaryGeneratorDelegate; +import org.camunda.bpm.engine.ExternalTaskService; +import org.camunda.bpm.engine.delegate.DelegateTask; +import org.camunda.bpm.engine.delegate.Expression; +import org.camunda.bpm.engine.delegate.TaskListener; +import org.camunda.bpm.engine.externaltask.LockedExternalTask; +import org.camunda.bpm.engine.runtime.ProcessInstance; +import org.camunda.bpm.engine.test.Deployment; +import org.camunda.bpm.engine.test.ProcessEngineRule; +import org.camunda.bpm.engine.test.mock.Mocks; +import org.camunda.bpm.extension.process_test_coverage.junit.rules.TestCoverageProcessEngineRuleBuilder; +import org.camunda.bpm.scenario.ProcessScenario; +import org.camunda.bpm.scenario.Scenario; +import org.camunda.bpm.scenario.delegate.ExternalTaskDelegate; +import org.camunda.bpm.scenario.delegate.TaskDelegate; +import org.junit.*; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.MockitoAnnotations; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; + +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import static org.camunda.bpm.engine.test.assertions.ProcessEngineTests.*; +import static org.camunda.bpm.extension.mockito.CamundaMockito.autoMock; +import static org.mockito.Mockito.when; + +/** + * This class tests the process execution of the Default-Process BPMN Model + * It verifies that each process task is called when it's supposed to be and + * delegation code is executed at the right time + *

+ * The tests run in an own Camunda engine which is defined by the camunda.cfg.xml in the resources directory + *

+ * The test cases use Camunda BPM's standard framework as well as the + * Camunda BPM Assert extension (), + * camunda-bpm-mockito () + * and the Camunda BPM Assert Scenario extension () + *

+ * Furthermore this class also uses the Camunda BPM Process Test Coverage extension + * (). + * After the test is run we can examine the test coverage in the directory target/process-test-coverage + */ + +@RunWith(SpringJUnit4ClassRunner.class) +@Deployment(resources = "bpmn/ncrack_process.bpmn") +@Ignore("Ignored until problems with camunda testing frameworks are handled. Introduces via update to camunda 7.10") +public class NcrackProcessTest { + + //Define the Process Activity IDs + private static final String PROCESS_ID = "ncrack_brute_force_scan"; + private static final String DO_SCAN_TASK_ID = "ServiceTask_DoScan"; + private static final String CREATE_REPORT_TASK_ID = "ServiceTask_CreateSummary"; + private static final String APPROVE_RESULTS_TASK_ID = "UserTask_ApproveResults"; + + private final Map defaultVariables = new HashMap<>(); + + @Rule + @ClassRule + public static ProcessEngineRule processEngineRule = TestCoverageProcessEngineRuleBuilder.create().build(); + + @Mock + private ProcessScenario process; + + @Mock + private SummaryGeneratorDelegate summeryGeneratorDelegate; + + /** + * Executed before every test-case + * In this method default variables for the process and a default behaviour for the mocks + * in the process are defined+ + */ + @Before + public void init() { + + MockitoAnnotations.initMocks(this); + + //Creating a map of default variables for the process + defaultVariables.put(DefaultFields.PROCESS_AUTOMATED.name(), true); + defaultVariables.put(DefaultFields.PROCESS_CONTEXT.name(), "BodgeIT"); + + /* + Mocking everything in the BPMN Model + This includes ExecutionListeners, TaskListeners, JavaDelegates, etc. + Simply stated: Everything, that's executable code + + If you need to define custom behaviour for the Mocks you can do so by + registering Mocks with Camunda's method "Mocks.register(String key, Object value)". + Here the key describes a delegateExpression (as defined in BPMN model) and the value + describes the implementation of the code which should be executed + (Hint: You can put the real implementation as well as a fake one in there) + + Note: Most of the mocking methods seem to work only in combination with delegateExpressions + but not with class definitions as delegate implementation. + + If you have the path to your executable code (the class for delegate) as delegate implementation + then this guide is helpful: + https://blog.akquinet.de/2016/11/04/camunda-bpm-test-your-processes-based-on-plain-old-java-delegates/ + */ + autoMock("bpmn/ncrack_process.bpmn"); + + /* + Here we define a default behaviour for all the tasks in the BPMN model. + This behaviour can easily be overridden in test cases. + + The code inside the "thenReturn(...)" method specifies what should happen when process execution + waits at the given task + As a default behaviour we just complete the task and move on to the next one without changing anything + + Note that we have our own mock implementation in the last two when(...) statements. + This is because these tasks are external tasks which cannot be as easily completed as + ServiceTasks. They need an external worker to do so. + */ + when(process.waitsAtUserTask(Mockito.anyString())).thenReturn(TaskDelegate::complete); + when(process.waitsAtServiceTask(Mockito.anyString())).thenReturn(ExternalTaskDelegate::complete); + when(process.waitsAtServiceTask(DO_SCAN_TASK_ID)).thenReturn(task -> startExternalMockProcess("ncrack_brute_force_scan")); + } + + @Test + public void testAutomatedStart_shouldPass() { + + ProcessInstance processInstance = runtimeService().startProcessInstanceByKey(PROCESS_ID, defaultVariables); + + assertThat(processInstance).isStarted(); + } + + @Test + public void testManualStartWithDefaultConfiguration_shouldPass() { + ProcessInstance processInstance = runtimeService().startProcessInstanceByKey(PROCESS_ID, defaultVariables); + + assertThat(processInstance).isStarted(); + assertThat(processInstance).isWaitingAt(DO_SCAN_TASK_ID); + } + + @Test + public void testManualRunWithApprovedTestResults() { + + Map variables = new HashMap<>(defaultVariables); + changeVariable(variables, DefaultFields.PROCESS_AUTOMATED.name(), false); + + when(process.waitsAtUserTask(APPROVE_RESULTS_TASK_ID)).thenReturn(task -> { + variables.put(DefaultFields.PROCESS_RESULT_APPROVED.name(), "approved"); + task.complete(variables); + }); + + /* + Here we register a custom mock. + The BPMN model TaskListener takes an injected field variable which cannot be mocked. + Therefore we create our own TaskListener with a dummy implementation and which also + holds the variable, that should be injected. + Then we register our TaskListener with "Mocks.register(...)" and it gets executed when the delegateExpression + is called. + */ + Mocks.register("setFormUrlListener", new TaskListener() { + + @Autowired + private Expression scanner_type; + + @Override + public void notify(DelegateTask delegateTask) { + } + }); + + Scenario scenario = Scenario.run(process).startByKey(PROCESS_ID, variables).execute(); + + assertThat(scenario.instance(process)).isEnded(); + assertThat(scenario.instance(process)).hasPassed(APPROVE_RESULTS_TASK_ID); + assertThat(scenario.instance(process)).variables() + .containsEntry(DefaultFields.PROCESS_RESULT_APPROVED.name(), "approved"); + } + + /** + * Executes an external process without doing anything in the task. + * In the first step the job is executed on the Camunda engine. Therefore the token for the + * provided topic gets pushed. Then an external service is called to pull the token and execute the task + * + * @param topic the topic for the external task + */ + private void startExternalMockProcess(String topic) { + + ExternalTaskService externalTaskService = processEngine().getExternalTaskService(); + List lockedExternalTasks = externalTaskService.fetchAndLock(1, "worker") + .topic(topic, 5000L) + .execute(); + + assertThat(lockedExternalTasks.size()).isEqualTo(1); + + LockedExternalTask task = lockedExternalTasks.get(0); + externalTaskService.complete(task.getId(), "worker"); + } + + private void changeVariable(Map variables, String key, Object value) { + + if (variables.containsKey(key)) { + variables.remove(key); + } + variables.put(key, value); + } + +} diff --git a/scb-scanprocesses/ncrack-process/src/test/resources/camunda.cfg.xml b/scb-scanprocesses/ncrack-process/src/test/resources/camunda.cfg.xml new file mode 100644 index 00000000..d5e7d6f9 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/test/resources/camunda.cfg.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + \ No newline at end of file diff --git a/scb-scanprocesses/ncrack-process/src/test/resources/logback-test.xml b/scb-scanprocesses/ncrack-process/src/test/resources/logback-test.xml new file mode 100644 index 00000000..81dcdbcd --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/test/resources/logback-test.xml @@ -0,0 +1,27 @@ + + + + + + + + + + diff --git a/scb-scanprocesses/pom.xml b/scb-scanprocesses/pom.xml index bedac331..8254fb8c 100644 --- a/scb-scanprocesses/pom.xml +++ b/scb-scanprocesses/pom.xml @@ -1,4 +1,4 @@ - + 4.0.0 @@ -26,6 +26,7 @@ amass-process ssh-process wordpress-process + ncrack-process - \ No newline at end of file + From 4769dd9513b1497b31c6d0f3b24c5364f185a71d Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Mon, 6 Jan 2020 16:27:37 +0100 Subject: [PATCH 02/11] Change bpmn general id. --- .../main/resources/bpmn/ncrack_process.bpmn | 109 +++++++++--------- 1 file changed, 55 insertions(+), 54 deletions(-) diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn index ddb96373..d468533e 100644 --- a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn +++ b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn @@ -1,6 +1,6 @@ - - + + @@ -32,7 +32,7 @@ SequenceFlow_ResultRejected - + ${PROCESS_RESULT_APPROVED == 'approved'} SequenceFlow_ScanFinished @@ -61,132 +61,133 @@ - + ${PROCESS_RESULT_APPROVED == 'disapproved'} SequenceFlow_ResultRejected SequenceFlow_1i44eck - results in a generic format - + + results in a generic format + - + - + - + - - + + - + - + - - + + - + - - + + - + - + - + - + - - + + - + - + - + - - - + + + - + - - - - + + + + - + - + - - + + - + - + - + - + - + - - + + - - - + + + - + - + - - - + + + From a1ac92c9b1e1194799f3287ea0539e6ef0d88d0c Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Tue, 14 Jan 2020 15:53:28 +0100 Subject: [PATCH 03/11] Renamed ressources folder to match the scan name --- .../{default => ncrack}/approve-results.html | 0 .../{default => ncrack}/configure-target.html | 48 ++++++++----------- 2 files changed, 19 insertions(+), 29 deletions(-) rename scb-scanprocesses/ncrack-process/src/main/resources/forms/{default => ncrack}/approve-results.html (100%) rename scb-scanprocesses/ncrack-process/src/main/resources/forms/{default => ncrack}/configure-target.html (71%) diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/approve-results.html similarity index 100% rename from scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html rename to scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/approve-results.html diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html similarity index 71% rename from scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html rename to scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html index a030d16c..73d79058 100644 --- a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html +++ b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html @@ -32,30 +32,20 @@

Please configure the Scan

camForm.on('variables-fetched', function () { $scope.context = camForm.variableManager.variableValue('DEFAULT_CONTEXT'); - $scope.targetList = [{ + $scope.target = { name: camForm.variableManager.variableValue('DEFAULT_TARGET_NAME'), - location: camForm.variableManager.variableValue('DEFAULT_TARGET_LOCATION') - }]; - - $scope.addTarget = function () { - $scope.targetList.push({'name':'', 'location': ''}); - }; - - $scope.checkForEnter = function ($event) { - if ($event.key === 'Enter') { - $scope.addTarget(); - $event.stopPropagation(); - $event.preventDefault(); + location: camForm.variableManager.variableValue('DEFAULT_TARGET_LOCATION'), + attributes: { + NCRACK_PARAMETER: '' } }; }); camForm.on('submit', function () { - camForm.variableManager.destroyVariable('PROCESS_TARGETS'); camForm.variableManager.createVariable({ name: 'PROCESS_TARGETS', type: 'Object', - value: JSON.stringify($scope.targetList), + value: JSON.stringify([ $scope.target ]), valueInfo: { serializationDataFormat: 'application/json', objectTypeName: 'java.lang.String' @@ -68,11 +58,11 @@

Please configure the Scan

-

Scan Target

+

Ncrack Target

-
+
Scan Target ng-model="target.name"/>
- +
-
- +
+ +
- - + {{ target }}
From 881d595c22d3a47af05f3b9be7a01a86f4eef76e Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Tue, 14 Jan 2020 15:54:00 +0100 Subject: [PATCH 04/11] Changed the form name on bpmn file --- .../src/main/resources/bpmn/ncrack_process.bpmn | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn index d468533e..5e619486 100644 --- a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn +++ b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn @@ -1,7 +1,7 @@ - - + + @@ -19,7 +19,7 @@ - + From 736e3fcbafa16f6fdfcb9a07af4d12e5515977e2 Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Mon, 2 Dec 2019 16:54:11 +0100 Subject: [PATCH 05/11] Added ncrack process --- Dockerfile | 2 +- scb-engine/pom.xml | 6 + scb-scanprocesses/ncrack-process/pom.xml | 74 ++++++ .../scanprocess/ProcessInitConfiguration.java | 36 +++ .../src/main/resources/META-INF/processes.xml | 0 .../main/resources/bpmn/ncrack_process.bpmn | 196 +++++++++++++++ .../forms/default/approve-results.html | 124 ++++++++++ .../forms/default/configure-target.html | 128 ++++++++++ .../scanprocess/test/NcrackProcessTest.java | 226 ++++++++++++++++++ .../src/test/resources/camunda.cfg.xml | 14 ++ .../src/test/resources/logback-test.xml | 27 +++ scb-scanprocesses/pom.xml | 5 +- 12 files changed, 835 insertions(+), 3 deletions(-) create mode 100644 scb-scanprocesses/ncrack-process/pom.xml create mode 100644 scb-scanprocesses/ncrack-process/src/main/java/io/securecodebox/scanprocess/ProcessInitConfiguration.java create mode 100644 scb-scanprocesses/ncrack-process/src/main/resources/META-INF/processes.xml create mode 100644 scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn create mode 100644 scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html create mode 100644 scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html create mode 100644 scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java create mode 100644 scb-scanprocesses/ncrack-process/src/test/resources/camunda.cfg.xml create mode 100644 scb-scanprocesses/ncrack-process/src/test/resources/logback-test.xml diff --git a/Dockerfile b/Dockerfile index 795e2164..8b568757 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,7 +23,7 @@ COPY --from=builder ./scb-scanprocesses/arachni-process/target/arachni-process-1 COPY --from=builder ./scb-scanprocesses/ssh-process/target/ssh-process-1.0-SNAPSHOT.jar /scb-engine/lib/ COPY --from=builder ./scb-scanprocesses/amass-process/target/amass-process-1.0-SNAPSHOT.jar /scb-engine/lib/ COPY --from=builder ./scb-scanprocesses/wordpress-process/target/wordpress-process-1.0-SNAPSHOT.jar /scb-engine/lib/ - +COPY --from=builder ./scb-scanprocesses/ncrack-process/target/ncrack-process-0.0.1-SNAPSHOT.jar /scb-engine/lib/ COPY --from=builder ./scb-persistenceproviders/elasticsearch-persistenceprovider/target/elasticsearch-persistenceprovider-0.0.1-SNAPSHOT-jar-with-dependencies.jar /scb-engine/lib/ COPY --from=builder ./scb-persistenceproviders/s3-persistenceprovider/target/s3-persistenceprovider-0.0.1-SNAPSHOT-jar-with-dependencies.jar /scb-engine/lib/ diff --git a/scb-engine/pom.xml b/scb-engine/pom.xml index cd04aae2..8c73aa6e 100644 --- a/scb-engine/pom.xml +++ b/scb-engine/pom.xml @@ -235,6 +235,12 @@ 1.0-SNAPSHOT runtime + + io.securecodebox.scanprocesses + ncrack-process + 0.0.1-SNAPSHOT + runtime + io.securecodebox.persistenceproviders elasticsearch-persistenceprovider diff --git a/scb-scanprocesses/ncrack-process/pom.xml b/scb-scanprocesses/ncrack-process/pom.xml new file mode 100644 index 00000000..460db104 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/pom.xml @@ -0,0 +1,74 @@ + + + + + 4.0.0 + + + io.securecodebox.scanprocesses + default-process-collection + 0.0.1-SNAPSHOT + + + io.securecodebox.scanprocesses + ncrack-process + 0.0.1-SNAPSHOT + + + + + io.securecodebox.core + sdk + ${project.parent.version} + + + + + com.h2database + h2 + + + org.camunda.bpm.springboot + camunda-bpm-spring-boot-starter-test + test + + + org.camunda.bpm.extension.mockito + camunda-bpm-mockito + test + + + org.camunda.bpm.extension + camunda-bpm-assert-scenario + test + + + org.camunda.bpm.extension + camunda-bpm-process-test-coverage + test + + + org.camunda.bpm.extension + camunda-bpm-assert + + + + diff --git a/scb-scanprocesses/ncrack-process/src/main/java/io/securecodebox/scanprocess/ProcessInitConfiguration.java b/scb-scanprocesses/ncrack-process/src/main/java/io/securecodebox/scanprocess/ProcessInitConfiguration.java new file mode 100644 index 00000000..033a2baa --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/main/java/io/securecodebox/scanprocess/ProcessInitConfiguration.java @@ -0,0 +1,36 @@ +/* + * + * SecureCodeBox (SCB) + * Copyright 2015-2018 iteratec GmbH + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * / + */ + +package io.securecodebox.scanprocess; + +import org.springframework.context.annotation.ComponentScan; +import org.springframework.context.annotation.Configuration; + +/** + * The secureCodeBox by default only scans for components in the package io.securecodebox.scanprocess. + *

+ * This configuration ensures that your defined package io.securecodebox.scanprocesses also gets scanned, please don't move or remove this configuration. + * + * @author Rüdiger Heins - iteratec GmbH + * @since 09.05.18 + */ +@ComponentScan("io.securecodebox.scanprocesses") +@Configuration +public class ProcessInitConfiguration { +} diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/META-INF/processes.xml b/scb-scanprocesses/ncrack-process/src/main/resources/META-INF/processes.xml new file mode 100644 index 00000000..e69de29b diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn new file mode 100644 index 00000000..ddb96373 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn @@ -0,0 +1,196 @@ + + + + + + + + + + + + + + SequenceFlow_TargetConfigured + + + + SequenceFlow_SummaryCreated + + + + + + + + SequenceFlow_ManualFinish + SequenceFlow_ResultReviewed + + + SequenceFlow_ResultReviewed + SequenceFlow_ResultApproved + SequenceFlow_ResultRejected + + + + + + SequenceFlow_ScanFinished + SequenceFlow_ManualFinish + SequenceFlow_AutomatedFinish + + + ${PROCESS_AUTOMATED == false} + + + ${PROCESS_AUTOMATED == true} + + + + SequenceFlow_TargetConfigured + SequenceFlow_ScanFinished + + + + + SequenceFlow_ResultApproved + SequenceFlow_1i44eck + SequenceFlow_AutomatedFinish + SequenceFlow_SummaryCreated + + + + + + + + SequenceFlow_ResultRejected + SequenceFlow_1i44eck + + + results in a generic format + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html new file mode 100644 index 00000000..d7326ad2 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html @@ -0,0 +1,124 @@ + + +

+ + +
+

scan results for "{{ target.name }}"

+ +
+
+
{{ scannerId }}
+
+
+
+
{{ target.location }}
+
+
+
+
{{ context }}
+
+
+
+ +
+ + + + + + + + + + + + + + + +
Host:Name:Category:Severity:Reference:
{{ result.location }}{{ result.name }}{{ result.category }} +
+ + + {{ result.severity }} + + + + + {{ result.severity }} + + + + + {{ result.severity }} + + + + + {{ result.severity }} + +
+ + 		{{ result.reference.id }} +
+
+
+ +
+
+

Approve Result

+ +
+ +
+ + +
+
+
diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html new file mode 100644 index 00000000..a030d16c --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html @@ -0,0 +1,128 @@ + + +

Please configure the Scan

+ +
+ + + +
+ +
+

Scan Target

+ + +
+
+
+ + +
+
+ + +
+
+ +
+
+ + +
+ + +
+ +
+ +
+
+ +
+
+
diff --git a/scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java b/scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java new file mode 100644 index 00000000..614d1485 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java @@ -0,0 +1,226 @@ +/* + * + * SecureCodeBox (SCB) + * Copyright 2015-2018 iteratec GmbH + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * / + */ + +package io.securecodebox.scanprocess.test; + +import io.securecodebox.constants.DefaultFields; +import io.securecodebox.scanprocess.delegate.SummaryGeneratorDelegate; +import org.camunda.bpm.engine.ExternalTaskService; +import org.camunda.bpm.engine.delegate.DelegateTask; +import org.camunda.bpm.engine.delegate.Expression; +import org.camunda.bpm.engine.delegate.TaskListener; +import org.camunda.bpm.engine.externaltask.LockedExternalTask; +import org.camunda.bpm.engine.runtime.ProcessInstance; +import org.camunda.bpm.engine.test.Deployment; +import org.camunda.bpm.engine.test.ProcessEngineRule; +import org.camunda.bpm.engine.test.mock.Mocks; +import org.camunda.bpm.extension.process_test_coverage.junit.rules.TestCoverageProcessEngineRuleBuilder; +import org.camunda.bpm.scenario.ProcessScenario; +import org.camunda.bpm.scenario.Scenario; +import org.camunda.bpm.scenario.delegate.ExternalTaskDelegate; +import org.camunda.bpm.scenario.delegate.TaskDelegate; +import org.junit.*; +import org.junit.runner.RunWith; +import org.mockito.Mock; +import org.mockito.Mockito; +import org.mockito.MockitoAnnotations; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; + +import java.util.HashMap; +import java.util.List; +import java.util.Map; + +import static org.camunda.bpm.engine.test.assertions.ProcessEngineTests.*; +import static org.camunda.bpm.extension.mockito.CamundaMockito.autoMock; +import static org.mockito.Mockito.when; + +/** + * This class tests the process execution of the Default-Process BPMN Model + * It verifies that each process task is called when it's supposed to be and + * delegation code is executed at the right time + *

+ * The tests run in an own Camunda engine which is defined by the camunda.cfg.xml in the resources directory + *

+ * The test cases use Camunda BPM's standard framework as well as the + * Camunda BPM Assert extension (), + * camunda-bpm-mockito () + * and the Camunda BPM Assert Scenario extension () + *

+ * Furthermore this class also uses the Camunda BPM Process Test Coverage extension + * (). + * After the test is run we can examine the test coverage in the directory target/process-test-coverage + */ + +@RunWith(SpringJUnit4ClassRunner.class) +@Deployment(resources = "bpmn/ncrack_process.bpmn") +@Ignore("Ignored until problems with camunda testing frameworks are handled. Introduces via update to camunda 7.10") +public class NcrackProcessTest { + + //Define the Process Activity IDs + private static final String PROCESS_ID = "ncrack_brute_force_scan"; + private static final String DO_SCAN_TASK_ID = "ServiceTask_DoScan"; + private static final String CREATE_REPORT_TASK_ID = "ServiceTask_CreateSummary"; + private static final String APPROVE_RESULTS_TASK_ID = "UserTask_ApproveResults"; + + private final Map defaultVariables = new HashMap<>(); + + @Rule + @ClassRule + public static ProcessEngineRule processEngineRule = TestCoverageProcessEngineRuleBuilder.create().build(); + + @Mock + private ProcessScenario process; + + @Mock + private SummaryGeneratorDelegate summeryGeneratorDelegate; + + /** + * Executed before every test-case + * In this method default variables for the process and a default behaviour for the mocks + * in the process are defined+ + */ + @Before + public void init() { + + MockitoAnnotations.initMocks(this); + + //Creating a map of default variables for the process + defaultVariables.put(DefaultFields.PROCESS_AUTOMATED.name(), true); + defaultVariables.put(DefaultFields.PROCESS_CONTEXT.name(), "BodgeIT"); + + /* + Mocking everything in the BPMN Model + This includes ExecutionListeners, TaskListeners, JavaDelegates, etc. + Simply stated: Everything, that's executable code + + If you need to define custom behaviour for the Mocks you can do so by + registering Mocks with Camunda's method "Mocks.register(String key, Object value)". + Here the key describes a delegateExpression (as defined in BPMN model) and the value + describes the implementation of the code which should be executed + (Hint: You can put the real implementation as well as a fake one in there) + + Note: Most of the mocking methods seem to work only in combination with delegateExpressions + but not with class definitions as delegate implementation. + + If you have the path to your executable code (the class for delegate) as delegate implementation + then this guide is helpful: + https://blog.akquinet.de/2016/11/04/camunda-bpm-test-your-processes-based-on-plain-old-java-delegates/ + */ + autoMock("bpmn/ncrack_process.bpmn"); + + /* + Here we define a default behaviour for all the tasks in the BPMN model. + This behaviour can easily be overridden in test cases. + + The code inside the "thenReturn(...)" method specifies what should happen when process execution + waits at the given task + As a default behaviour we just complete the task and move on to the next one without changing anything + + Note that we have our own mock implementation in the last two when(...) statements. + This is because these tasks are external tasks which cannot be as easily completed as + ServiceTasks. They need an external worker to do so. + */ + when(process.waitsAtUserTask(Mockito.anyString())).thenReturn(TaskDelegate::complete); + when(process.waitsAtServiceTask(Mockito.anyString())).thenReturn(ExternalTaskDelegate::complete); + when(process.waitsAtServiceTask(DO_SCAN_TASK_ID)).thenReturn(task -> startExternalMockProcess("ncrack_brute_force_scan")); + } + + @Test + public void testAutomatedStart_shouldPass() { + + ProcessInstance processInstance = runtimeService().startProcessInstanceByKey(PROCESS_ID, defaultVariables); + + assertThat(processInstance).isStarted(); + } + + @Test + public void testManualStartWithDefaultConfiguration_shouldPass() { + ProcessInstance processInstance = runtimeService().startProcessInstanceByKey(PROCESS_ID, defaultVariables); + + assertThat(processInstance).isStarted(); + assertThat(processInstance).isWaitingAt(DO_SCAN_TASK_ID); + } + + @Test + public void testManualRunWithApprovedTestResults() { + + Map variables = new HashMap<>(defaultVariables); + changeVariable(variables, DefaultFields.PROCESS_AUTOMATED.name(), false); + + when(process.waitsAtUserTask(APPROVE_RESULTS_TASK_ID)).thenReturn(task -> { + variables.put(DefaultFields.PROCESS_RESULT_APPROVED.name(), "approved"); + task.complete(variables); + }); + + /* + Here we register a custom mock. + The BPMN model TaskListener takes an injected field variable which cannot be mocked. + Therefore we create our own TaskListener with a dummy implementation and which also + holds the variable, that should be injected. + Then we register our TaskListener with "Mocks.register(...)" and it gets executed when the delegateExpression + is called. + */ + Mocks.register("setFormUrlListener", new TaskListener() { + + @Autowired + private Expression scanner_type; + + @Override + public void notify(DelegateTask delegateTask) { + } + }); + + Scenario scenario = Scenario.run(process).startByKey(PROCESS_ID, variables).execute(); + + assertThat(scenario.instance(process)).isEnded(); + assertThat(scenario.instance(process)).hasPassed(APPROVE_RESULTS_TASK_ID); + assertThat(scenario.instance(process)).variables() + .containsEntry(DefaultFields.PROCESS_RESULT_APPROVED.name(), "approved"); + } + + /** + * Executes an external process without doing anything in the task. + * In the first step the job is executed on the Camunda engine. Therefore the token for the + * provided topic gets pushed. Then an external service is called to pull the token and execute the task + * + * @param topic the topic for the external task + */ + private void startExternalMockProcess(String topic) { + + ExternalTaskService externalTaskService = processEngine().getExternalTaskService(); + List lockedExternalTasks = externalTaskService.fetchAndLock(1, "worker") + .topic(topic, 5000L) + .execute(); + + assertThat(lockedExternalTasks.size()).isEqualTo(1); + + LockedExternalTask task = lockedExternalTasks.get(0); + externalTaskService.complete(task.getId(), "worker"); + } + + private void changeVariable(Map variables, String key, Object value) { + + if (variables.containsKey(key)) { + variables.remove(key); + } + variables.put(key, value); + } + +} diff --git a/scb-scanprocesses/ncrack-process/src/test/resources/camunda.cfg.xml b/scb-scanprocesses/ncrack-process/src/test/resources/camunda.cfg.xml new file mode 100644 index 00000000..d5e7d6f9 --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/test/resources/camunda.cfg.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + \ No newline at end of file diff --git a/scb-scanprocesses/ncrack-process/src/test/resources/logback-test.xml b/scb-scanprocesses/ncrack-process/src/test/resources/logback-test.xml new file mode 100644 index 00000000..81dcdbcd --- /dev/null +++ b/scb-scanprocesses/ncrack-process/src/test/resources/logback-test.xml @@ -0,0 +1,27 @@ + + + + + + + + + + diff --git a/scb-scanprocesses/pom.xml b/scb-scanprocesses/pom.xml index bedac331..8254fb8c 100644 --- a/scb-scanprocesses/pom.xml +++ b/scb-scanprocesses/pom.xml @@ -1,4 +1,4 @@ - + 4.0.0 @@ -26,6 +26,7 @@ amass-process ssh-process wordpress-process + ncrack-process - \ No newline at end of file + From a9f688bf76b73cf69502b4a4eeeca0f79f3e330f Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Mon, 6 Jan 2020 16:27:37 +0100 Subject: [PATCH 06/11] Change bpmn general id. --- .../main/resources/bpmn/ncrack_process.bpmn | 109 +++++++++--------- 1 file changed, 55 insertions(+), 54 deletions(-) diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn index ddb96373..d468533e 100644 --- a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn +++ b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn @@ -1,6 +1,6 @@ - - + + @@ -32,7 +32,7 @@ SequenceFlow_ResultRejected - + ${PROCESS_RESULT_APPROVED == 'approved'} SequenceFlow_ScanFinished @@ -61,132 +61,133 @@ - + ${PROCESS_RESULT_APPROVED == 'disapproved'} SequenceFlow_ResultRejected SequenceFlow_1i44eck - results in a generic format - + + results in a generic format + - + - + - + - - + + - + - + - - + + - + - - + + - + - + - + - + - - + + - + - + - + - - - + + + - + - - - - + + + + - + - + - - + + - + - + - + - + - + - - + + - - - + + + - + - + - - - + + + From 2a898e32c5ca13c6964e8c94b1a0758a74a4468c Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Tue, 14 Jan 2020 15:53:28 +0100 Subject: [PATCH 07/11] Renamed ressources folder to match the scan name --- .../{default => ncrack}/approve-results.html | 0 .../{default => ncrack}/configure-target.html | 48 ++++++++----------- 2 files changed, 19 insertions(+), 29 deletions(-) rename scb-scanprocesses/ncrack-process/src/main/resources/forms/{default => ncrack}/approve-results.html (100%) rename scb-scanprocesses/ncrack-process/src/main/resources/forms/{default => ncrack}/configure-target.html (71%) diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/approve-results.html similarity index 100% rename from scb-scanprocesses/ncrack-process/src/main/resources/forms/default/approve-results.html rename to scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/approve-results.html diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html similarity index 71% rename from scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html rename to scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html index a030d16c..73d79058 100644 --- a/scb-scanprocesses/ncrack-process/src/main/resources/forms/default/configure-target.html +++ b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html @@ -32,30 +32,20 @@

Please configure the Scan

camForm.on('variables-fetched', function () { $scope.context = camForm.variableManager.variableValue('DEFAULT_CONTEXT'); - $scope.targetList = [{ + $scope.target = { name: camForm.variableManager.variableValue('DEFAULT_TARGET_NAME'), - location: camForm.variableManager.variableValue('DEFAULT_TARGET_LOCATION') - }]; - - $scope.addTarget = function () { - $scope.targetList.push({'name':'', 'location': ''}); - }; - - $scope.checkForEnter = function ($event) { - if ($event.key === 'Enter') { - $scope.addTarget(); - $event.stopPropagation(); - $event.preventDefault(); + location: camForm.variableManager.variableValue('DEFAULT_TARGET_LOCATION'), + attributes: { + NCRACK_PARAMETER: '' } }; }); camForm.on('submit', function () { - camForm.variableManager.destroyVariable('PROCESS_TARGETS'); camForm.variableManager.createVariable({ name: 'PROCESS_TARGETS', type: 'Object', - value: JSON.stringify($scope.targetList), + value: JSON.stringify([ $scope.target ]), valueInfo: { serializationDataFormat: 'application/json', objectTypeName: 'java.lang.String' @@ -68,11 +58,11 @@

Please configure the Scan

-

Scan Target

+

Ncrack Target

-
+
Scan Target ng-model="target.name"/>
- +
-
- +
+ +
- - + {{ target }}
From 0d6da4b0cfaf7d4885818f659e226fafb8f93007 Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Tue, 14 Jan 2020 15:54:00 +0100 Subject: [PATCH 08/11] Changed the form name on bpmn file --- .../src/main/resources/bpmn/ncrack_process.bpmn | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn index d468533e..5e619486 100644 --- a/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn +++ b/scb-scanprocesses/ncrack-process/src/main/resources/bpmn/ncrack_process.bpmn @@ -1,7 +1,7 @@ - - + + @@ -19,7 +19,7 @@ - + From a69cb2f10a4aae910344badec9c0518a33eb0c72 Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Tue, 14 Jan 2020 16:27:47 +0100 Subject: [PATCH 09/11] Changed width of the input field --- .../src/main/resources/forms/ncrack/configure-target.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html index 73d79058..e17c532f 100644 --- a/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html +++ b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html @@ -63,7 +63,7 @@

Ncrack Target

-
+
Date: Thu, 16 Jan 2020 11:59:26 +0100 Subject: [PATCH 10/11] Added username and password information to the review results page --- .../resources/forms/ncrack/approve-results.html | 14 +++++++------- .../resources/forms/ncrack/configure-target.html | 6 +----- 2 files changed, 8 insertions(+), 12 deletions(-) diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/approve-results.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/approve-results.html index d7326ad2..ee80be0e 100644 --- a/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/approve-results.html +++ b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/approve-results.html @@ -30,14 +30,13 @@ camForm.on('variables-restored', function () { $scope.context = camForm.variableManager.variableValue('PROCESS_CONTEXT'); - $scope.scannerId = camForm.variableManager.variableValue('PROCESS_SCANNER_ID'); $scope.scannerResult = JSON.parse(camForm.variableManager.variableValue('PROCESS_FINDINGS')); $scope.scannerTargets = JSON.parse(camForm.variableManager.variableValue('PROCESS_TARGETS')); });
-

scan results for "{{ target.name }}"

+

Ncrack Scan Results for "{{ target.name }}"

@@ -59,15 +58,16 @@

scan results for "{{ target.name }}"

+ - - + + + - - + +
Host:Service: Name:Category: Severity:Reference:Username:Password:
{{ result.location }}{{ result.attributes.service }} {{ result.name }}{{ result.category }}
@@ -96,8 +96,8 @@

scan results for "{{ target.name }}"

 {{ result.reference.id }} - {{ result.attributes.username }} {{ result.attributes.password }}
diff --git a/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html index b7b9e489..29fced82 100644 --- a/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html +++ b/scb-scanprocesses/ncrack-process/src/main/resources/forms/ncrack/configure-target.html @@ -63,11 +63,7 @@

Ncrack Target

-<<<<<<< HEAD
-======= -
->>>>>>> 881d595c22d3a47af05f3b9be7a01a86f4eef76e Ncrack Target />
- {{ target }} +
From 1657fb9c202a7f39729aefad4ebd46e21340868b Mon Sep 17 00:00:00 2001 From: Jorge Estigarribia Date: Fri, 17 Jan 2020 16:33:34 +0100 Subject: [PATCH 11/11] Deleted automatic generated file --- .../scanprocess/test/NcrackProcessTest.java | 226 ------------------ 1 file changed, 226 deletions(-) delete mode 100644 scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java diff --git a/scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java b/scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java deleted file mode 100644 index 614d1485..00000000 --- a/scb-scanprocesses/ncrack-process/src/test/java/io/securecodebox/scanprocess/test/NcrackProcessTest.java +++ /dev/null @@ -1,226 +0,0 @@ -/* - * - * SecureCodeBox (SCB) - * Copyright 2015-2018 iteratec GmbH - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * / - */ - -package io.securecodebox.scanprocess.test; - -import io.securecodebox.constants.DefaultFields; -import io.securecodebox.scanprocess.delegate.SummaryGeneratorDelegate; -import org.camunda.bpm.engine.ExternalTaskService; -import org.camunda.bpm.engine.delegate.DelegateTask; -import org.camunda.bpm.engine.delegate.Expression; -import org.camunda.bpm.engine.delegate.TaskListener; -import org.camunda.bpm.engine.externaltask.LockedExternalTask; -import org.camunda.bpm.engine.runtime.ProcessInstance; -import org.camunda.bpm.engine.test.Deployment; -import org.camunda.bpm.engine.test.ProcessEngineRule; -import org.camunda.bpm.engine.test.mock.Mocks; -import org.camunda.bpm.extension.process_test_coverage.junit.rules.TestCoverageProcessEngineRuleBuilder; -import org.camunda.bpm.scenario.ProcessScenario; -import org.camunda.bpm.scenario.Scenario; -import org.camunda.bpm.scenario.delegate.ExternalTaskDelegate; -import org.camunda.bpm.scenario.delegate.TaskDelegate; -import org.junit.*; -import org.junit.runner.RunWith; -import org.mockito.Mock; -import org.mockito.Mockito; -import org.mockito.MockitoAnnotations; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; - -import java.util.HashMap; -import java.util.List; -import java.util.Map; - -import static org.camunda.bpm.engine.test.assertions.ProcessEngineTests.*; -import static org.camunda.bpm.extension.mockito.CamundaMockito.autoMock; -import static org.mockito.Mockito.when; - -/** - * This class tests the process execution of the Default-Process BPMN Model - * It verifies that each process task is called when it's supposed to be and - * delegation code is executed at the right time - *

- * The tests run in an own Camunda engine which is defined by the camunda.cfg.xml in the resources directory - *

- * The test cases use Camunda BPM's standard framework as well as the - * Camunda BPM Assert extension (), - * camunda-bpm-mockito () - * and the Camunda BPM Assert Scenario extension () - *

- * Furthermore this class also uses the Camunda BPM Process Test Coverage extension - * (). - * After the test is run we can examine the test coverage in the directory target/process-test-coverage - */ - -@RunWith(SpringJUnit4ClassRunner.class) -@Deployment(resources = "bpmn/ncrack_process.bpmn") -@Ignore("Ignored until problems with camunda testing frameworks are handled. Introduces via update to camunda 7.10") -public class NcrackProcessTest { - - //Define the Process Activity IDs - private static final String PROCESS_ID = "ncrack_brute_force_scan"; - private static final String DO_SCAN_TASK_ID = "ServiceTask_DoScan"; - private static final String CREATE_REPORT_TASK_ID = "ServiceTask_CreateSummary"; - private static final String APPROVE_RESULTS_TASK_ID = "UserTask_ApproveResults"; - - private final Map defaultVariables = new HashMap<>(); - - @Rule - @ClassRule - public static ProcessEngineRule processEngineRule = TestCoverageProcessEngineRuleBuilder.create().build(); - - @Mock - private ProcessScenario process; - - @Mock - private SummaryGeneratorDelegate summeryGeneratorDelegate; - - /** - * Executed before every test-case - * In this method default variables for the process and a default behaviour for the mocks - * in the process are defined+ - */ - @Before - public void init() { - - MockitoAnnotations.initMocks(this); - - //Creating a map of default variables for the process - defaultVariables.put(DefaultFields.PROCESS_AUTOMATED.name(), true); - defaultVariables.put(DefaultFields.PROCESS_CONTEXT.name(), "BodgeIT"); - - /* - Mocking everything in the BPMN Model - This includes ExecutionListeners, TaskListeners, JavaDelegates, etc. - Simply stated: Everything, that's executable code - - If you need to define custom behaviour for the Mocks you can do so by - registering Mocks with Camunda's method "Mocks.register(String key, Object value)". - Here the key describes a delegateExpression (as defined in BPMN model) and the value - describes the implementation of the code which should be executed - (Hint: You can put the real implementation as well as a fake one in there) - - Note: Most of the mocking methods seem to work only in combination with delegateExpressions - but not with class definitions as delegate implementation. - - If you have the path to your executable code (the class for delegate) as delegate implementation - then this guide is helpful: - https://blog.akquinet.de/2016/11/04/camunda-bpm-test-your-processes-based-on-plain-old-java-delegates/ - */ - autoMock("bpmn/ncrack_process.bpmn"); - - /* - Here we define a default behaviour for all the tasks in the BPMN model. - This behaviour can easily be overridden in test cases. - - The code inside the "thenReturn(...)" method specifies what should happen when process execution - waits at the given task - As a default behaviour we just complete the task and move on to the next one without changing anything - - Note that we have our own mock implementation in the last two when(...) statements. - This is because these tasks are external tasks which cannot be as easily completed as - ServiceTasks. They need an external worker to do so. - */ - when(process.waitsAtUserTask(Mockito.anyString())).thenReturn(TaskDelegate::complete); - when(process.waitsAtServiceTask(Mockito.anyString())).thenReturn(ExternalTaskDelegate::complete); - when(process.waitsAtServiceTask(DO_SCAN_TASK_ID)).thenReturn(task -> startExternalMockProcess("ncrack_brute_force_scan")); - } - - @Test - public void testAutomatedStart_shouldPass() { - - ProcessInstance processInstance = runtimeService().startProcessInstanceByKey(PROCESS_ID, defaultVariables); - - assertThat(processInstance).isStarted(); - } - - @Test - public void testManualStartWithDefaultConfiguration_shouldPass() { - ProcessInstance processInstance = runtimeService().startProcessInstanceByKey(PROCESS_ID, defaultVariables); - - assertThat(processInstance).isStarted(); - assertThat(processInstance).isWaitingAt(DO_SCAN_TASK_ID); - } - - @Test - public void testManualRunWithApprovedTestResults() { - - Map variables = new HashMap<>(defaultVariables); - changeVariable(variables, DefaultFields.PROCESS_AUTOMATED.name(), false); - - when(process.waitsAtUserTask(APPROVE_RESULTS_TASK_ID)).thenReturn(task -> { - variables.put(DefaultFields.PROCESS_RESULT_APPROVED.name(), "approved"); - task.complete(variables); - }); - - /* - Here we register a custom mock. - The BPMN model TaskListener takes an injected field variable which cannot be mocked. - Therefore we create our own TaskListener with a dummy implementation and which also - holds the variable, that should be injected. - Then we register our TaskListener with "Mocks.register(...)" and it gets executed when the delegateExpression - is called. - */ - Mocks.register("setFormUrlListener", new TaskListener() { - - @Autowired - private Expression scanner_type; - - @Override - public void notify(DelegateTask delegateTask) { - } - }); - - Scenario scenario = Scenario.run(process).startByKey(PROCESS_ID, variables).execute(); - - assertThat(scenario.instance(process)).isEnded(); - assertThat(scenario.instance(process)).hasPassed(APPROVE_RESULTS_TASK_ID); - assertThat(scenario.instance(process)).variables() - .containsEntry(DefaultFields.PROCESS_RESULT_APPROVED.name(), "approved"); - } - - /** - * Executes an external process without doing anything in the task. - * In the first step the job is executed on the Camunda engine. Therefore the token for the - * provided topic gets pushed. Then an external service is called to pull the token and execute the task - * - * @param topic the topic for the external task - */ - private void startExternalMockProcess(String topic) { - - ExternalTaskService externalTaskService = processEngine().getExternalTaskService(); - List lockedExternalTasks = externalTaskService.fetchAndLock(1, "worker") - .topic(topic, 5000L) - .execute(); - - assertThat(lockedExternalTasks.size()).isEqualTo(1); - - LockedExternalTask task = lockedExternalTasks.get(0); - externalTaskService.complete(task.getId(), "worker"); - } - - private void changeVariable(Map variables, String key, Object value) { - - if (variables.containsKey(key)) { - variables.remove(key); - } - variables.put(key, value); - } - -}