From 66eb74c2bcb680bed79bc1ac4daeb99a4376073b Mon Sep 17 00:00:00 2001 From: Tio Gobin Date: Tue, 4 Aug 2020 16:26:09 +0200 Subject: [PATCH 01/21] OSC Provider linked to osc_sdk_python, and started osc facade / resource --- ScoutSuite/core/cli_parser.py | 15 +- ScoutSuite/providers/__init__.py | 5 +- .../base/authentication_strategy_factory.py | 3 +- ScoutSuite/providers/osc/__init__.py | 0 .../providers/osc/authentication_strategy.py | 166 ++++++++++++++++++ ScoutSuite/providers/osc/facade/api.py | 18 ++ ScoutSuite/providers/osc/facade/base.py | 16 ++ ScoutSuite/providers/osc/facade/basefacade.py | 6 + ScoutSuite/providers/osc/facade/utils.py | 18 ++ ScoutSuite/providers/osc/provider.py | 35 ++++ .../providers/osc/resources/api/base.py | 21 +++ .../providers/osc/resources/api/instances.py | 0 .../providers/osc/resources/api/snapshots.py | 15 ++ .../providers/osc/resources/api/volumes.py | 0 .../providers/osc/resources/api/vpcs.py | 0 ScoutSuite/providers/osc/resources/base.py | 16 ++ ScoutSuite/providers/osc/resources/regions.py | 26 +++ ScoutSuite/providers/osc/services.py | 22 +++ requirements.txt | 3 + 19 files changed, 382 insertions(+), 3 deletions(-) create mode 100644 ScoutSuite/providers/osc/__init__.py create mode 100644 ScoutSuite/providers/osc/authentication_strategy.py create mode 100644 ScoutSuite/providers/osc/facade/api.py create mode 100644 ScoutSuite/providers/osc/facade/base.py create mode 100644 ScoutSuite/providers/osc/facade/basefacade.py create mode 100644 ScoutSuite/providers/osc/facade/utils.py create mode 100644 ScoutSuite/providers/osc/provider.py create mode 100644 ScoutSuite/providers/osc/resources/api/base.py create mode 100644 ScoutSuite/providers/osc/resources/api/instances.py create mode 100644 ScoutSuite/providers/osc/resources/api/snapshots.py create mode 100644 ScoutSuite/providers/osc/resources/api/volumes.py create mode 100644 ScoutSuite/providers/osc/resources/api/vpcs.py create mode 100644 ScoutSuite/providers/osc/resources/base.py create mode 100644 ScoutSuite/providers/osc/resources/regions.py create mode 100644 ScoutSuite/providers/osc/services.py diff --git a/ScoutSuite/core/cli_parser.py b/ScoutSuite/core/cli_parser.py index a6481d3bf..88a3d9f22 100755 --- a/ScoutSuite/core/cli_parser.py +++ b/ScoutSuite/core/cli_parser.py @@ -23,12 +23,12 @@ def __init__(self): dest="provider") self._init_common_args_parser() - self._init_aws_parser() self._init_gcp_parser() self._init_azure_parser() self._init_aliyun_parser() self._init_oci_parser() + self._init_osc_parser() def _init_aws_parser(self): parser = self.subparsers.add_parser("aws", @@ -372,6 +372,19 @@ def _init_common_args_parser(self): default=8000, help="[EXPERIMENTAL FEATURE] Port on which you want the server to listen. Defaults to 8000.") + def _init_osc_parser(self): + parser = self.subparsers.add_parser("osc", + parents=[self.common_providers_args_parser], + help="Run Scout against an Outsccale account") + + osc_parser = parser.add_argument_group('Authentication modes') + + osc_parser.add_argument('-p', + '--profile', + dest='profile', + default=None, + help='Run with a named profile') + def parse_args(self, args=None): args = self.parser.parse_args(args) diff --git a/ScoutSuite/providers/__init__.py b/ScoutSuite/providers/__init__.py index abee8205a..686b2e150 100755 --- a/ScoutSuite/providers/__init__.py +++ b/ScoutSuite/providers/__init__.py @@ -1,8 +1,11 @@ +import logging + providers_dict = {'aws': 'AWSProvider', 'gcp': 'GCPProvider', 'azure': 'AzureProvider', 'aliyun': 'AliyunProvider', - 'oci': 'OracleProvider'} + 'oci': 'OracleProvider', + 'osc': 'OutscaleProvider'} def get_provider_object(provider): diff --git a/ScoutSuite/providers/base/authentication_strategy_factory.py b/ScoutSuite/providers/base/authentication_strategy_factory.py index 25e786153..93c395766 100755 --- a/ScoutSuite/providers/base/authentication_strategy_factory.py +++ b/ScoutSuite/providers/base/authentication_strategy_factory.py @@ -3,7 +3,8 @@ 'gcp': 'GCPAuthenticationStrategy', 'azure': 'AzureAuthenticationStrategy', 'aliyun': 'AliyunAuthenticationStrategy', - 'oci': 'OracleAuthenticationStrategy' + 'oci': 'OracleAuthenticationStrategy', + 'osc': 'OutscaleAuthenticationStrategy' } diff --git a/ScoutSuite/providers/osc/__init__.py b/ScoutSuite/providers/osc/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/ScoutSuite/providers/osc/authentication_strategy.py b/ScoutSuite/providers/osc/authentication_strategy.py new file mode 100644 index 000000000..380bf88e4 --- /dev/null +++ b/ScoutSuite/providers/osc/authentication_strategy.py @@ -0,0 +1,166 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +from datetime import datetime +import hashlib +import hmac +from urllib.parse import quote as urlquote +import requests +import json +# from ScoutSuite.providers.osc.utils import urlquote +from ScoutSuite.providers.base.authentication_strategy import AuthenticationStrategy, AuthenticationException +from osc_sdk_python import Gateway + +__all__ = [ + 'OSCRequestSignerAlgorithmV4', +] + + +class OSCRequestSigner(object): + """ + Class which handles signing the outgoing AWS requests. + """ + + def __init__(self, access_key, access_secret, version="latest", + connection=None): + """ + :param access_key: Access key. + :type access_key: ``str`` + + :param access_secret: Access secret. + :type access_secret: ``str`` + + :param version: API version. + :type version: ``str`` + + :param connection: Connection instance. + :type connection: :class:`Connection` + """ + self.access_key = access_key + self.access_secret = access_secret + self.version = version + self.connection = connection + + +class OSCRequestSignerAlgorithmV4(OSCRequestSigner): + @staticmethod + def sign(key, msg): + return hmac.new(key, msg.encode("utf-8"), hashlib.sha256).digest() + + @staticmethod + def _get_signed_headers(headers): + return ';'.join([k.lower() for k in sorted(headers.keys())]) + + @staticmethod + def _get_canonical_headers(headers): + return '\n'.join([':'.join([k.lower(), str(v).strip()]) + for k, v in sorted(headers.items())]) + '\n' + + @staticmethod + def _get_request_params(params): + return '&'.join(["%s=%s" % + (urlquote(k, safe=''), urlquote(str(v), safe='~')) + for k, v in sorted(params.items())]) + + def get_request_headers(self, service_name, region, action, + data=None): + date = datetime.utcnow() + host = "{}.{}.outscale.com".format(service_name, region) + headers = { + 'Content-Type': "application/json; charset=utf-8", + 'X-Osc-Date': date.strftime('%Y%m%dT%H%M%SZ'), + 'Host': host, + } + path = "/{}/{}/{}".format( + service_name, + self.version, + action + ) + sig = self._get_authorization_v4_header( + headers=headers, + dt=date, + method='POST', + path=path, + data=data + ) + headers.update({'Authorization': sig}) + return headers + + def _get_authorization_v4_header(self, headers, dt, method='GET', + path='/', data=None): + credentials_scope = self._get_credential_scope(dt=dt) + signed_headers = self._get_signed_headers(headers=headers) + signature = self._get_signature(headers=headers, dt=dt, + method=method, path=path, + data=data) + return 'OSC4-HMAC-SHA256 Credential=%(u)s/%(c)s, ' \ + 'SignedHeaders=%(sh)s, Signature=%(s)s' % { + 'u': self.access_key, + 'c': credentials_scope, + 'sh': signed_headers, + 's': signature + } + + def _get_signature(self, headers, dt, method, path, data): + string_to_sign = self._get_string_to_sign(headers=headers, dt=dt, + method=method, path=path, + data=data) + signing_key = self._get_key_to_sign_with(self.access_secret, dt) + return hmac.new(signing_key, string_to_sign.encode('utf-8'), + hashlib.sha256).hexdigest() + + def _get_key_to_sign_with(self, key, dt): + dt = dt.strftime('%Y%m%d') + k_date = self.sign(('OSC4' + key).encode('utf-8'), dt) + k_region = self.sign(k_date, self.connection.region_name) + k_service = self.sign(k_region, self.connection.service_name) + return self.sign(k_service, 'osc4_request') + + def _get_string_to_sign(self, headers, dt, method, path, data): + canonical_request = self._get_canonical_request(headers=headers, + method=method, + path=path, + data=data) + return 'OSC4-HMAC-SHA256' + '\n' \ + + dt.strftime('%Y%m%dT%H%M%SZ') + '\n' \ + + self._get_credential_scope(dt) + '\n' \ + + hashlib.sha256(canonical_request.encode('utf-8')).hexdigest() + + def _get_credential_scope(self, dt): + return '/'.join([dt.strftime('%Y%m%d'), + self.connection.region_name, + self.connection.service_name, + 'osc4_request']) + + def _get_canonical_request(self, headers, method, path, data="{}"): + data = data if data else "{}" + return '\n'.join([ + method, + path, + self._get_request_params({}), + self._get_canonical_headers(headers), + self._get_signed_headers(headers), + hashlib.sha256(data.encode('utf-8')).hexdigest() + ]) + + +class OutscaleAuthenticationStrategy(AuthenticationStrategy): + def authenticate(self, profile=None, osc_access_key=None, + osc_secret_access_key=None, **kwargs): + try: + session = Gateway() + return session + except Exception as e: + raise AuthenticationException(e) diff --git a/ScoutSuite/providers/osc/facade/api.py b/ScoutSuite/providers/osc/facade/api.py new file mode 100644 index 000000000..2ce6c68b0 --- /dev/null +++ b/ScoutSuite/providers/osc/facade/api.py @@ -0,0 +1,18 @@ +from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade +from osc_sdk_python import Gateway +from ScoutSuite.providers.osc.facade.utils import OSCFacadeUtils +from ScoutSuite.core.console import print_exception + + +class ApiFacade(OSCBaseFacade): + + def __init__(self, session: Gateway): + super(ApiFacade, self).init(session) + + async def get_instances(self, region: str): + try: + instances = OSCFacadeUtils.get_all_instances(self.session) + except Exception as e: + print_exception('Failed to describe instances: {}'.format(e)) + return [] + diff --git a/ScoutSuite/providers/osc/facade/base.py b/ScoutSuite/providers/osc/facade/base.py new file mode 100644 index 000000000..2d621ce0d --- /dev/null +++ b/ScoutSuite/providers/osc/facade/base.py @@ -0,0 +1,16 @@ +from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade +from ScoutSuite.providers.osc.facade.api import ApiFacade + + +class OSCFacade(OSCBaseFacade): + def __init__(self, credentials=None): + super(OSCFacade, self).__init__() + self.session = credentials.session + self._instantiate_facades() + + async def build_region_list(self, service: str, chosen_regions=None, + excluded_regions=None, partition_name='osc'): + region = self.session.list_locations() + + def _instantiate_facades(self): + self.api = ApiFacade(self.session) \ No newline at end of file diff --git a/ScoutSuite/providers/osc/facade/basefacade.py b/ScoutSuite/providers/osc/facade/basefacade.py new file mode 100644 index 000000000..84bec1c64 --- /dev/null +++ b/ScoutSuite/providers/osc/facade/basefacade.py @@ -0,0 +1,6 @@ +from osc_sdk_python import Gateway + + +class OSCBaseFacade(object): + def __init__(self, session: Gateway = None): + self.session = session diff --git a/ScoutSuite/providers/osc/facade/utils.py b/ScoutSuite/providers/osc/facade/utils.py new file mode 100644 index 000000000..a2a27ab1a --- /dev/null +++ b/ScoutSuite/providers/osc/facade/utils.py @@ -0,0 +1,18 @@ +import json +import requests + +from ScoutSuite.providers.osc.authentication_strategy import \ + OSCRequestSignerAlgorithmV4 + + +class OSCFacadeUtils: + @staticmethod + def get_all_pages(self, session): + return session.ReadVms + @staticmethod + def _get_outscale_endpoint(region, version, action): + return "https://api.{}.outscale.com/api/{}/{}".format( + region, + version, + action + ) diff --git a/ScoutSuite/providers/osc/provider.py b/ScoutSuite/providers/osc/provider.py new file mode 100644 index 000000000..074e6d3a6 --- /dev/null +++ b/ScoutSuite/providers/osc/provider.py @@ -0,0 +1,35 @@ +import os + +from ScoutSuite.providers.base.provider import BaseProvider +from ScoutSuite.providers.osc.services import OSCServicesConfig +#from ScoutSuite.providers.osc.utils import get_partition_name + + +class OutscaleProvider(BaseProvider): + """ + Implements provider for Outscale + """ + + def __init__(self, profile='default', report_dir=None, timestamp=None, + services=None, skipped_services=None, result_format='json', **kwargs): + services = [] if services is None else services + skipped_services = [] if skipped_services is None else skipped_services + + self.metadata_path = '%s/metadata.json' % os.path.split(os.path.abspath(__file__))[0] + + self.sg_map = {} + self.subnet_map = {} + + self.profile = profile + self.services_config = OSCServicesConfig + + self.provider_code = 'osc' + self.provider_name = 'Outscale API' + self.environment = self.profile + self.result_format = result_format + + self.credentials = kwargs['credentials'] + + super(OutscaleProvider, self).__init__(report_dir, timestamp, + services, skipped_services, + result_format) diff --git a/ScoutSuite/providers/osc/resources/api/base.py b/ScoutSuite/providers/osc/resources/api/base.py new file mode 100644 index 000000000..b8a4c6500 --- /dev/null +++ b/ScoutSuite/providers/osc/resources/api/base.py @@ -0,0 +1,21 @@ +from ScoutSuite.providers.osc.resources.api.snapshots import Snapshots +#from ScoutSuite.providers.osc.resources.api.volumes import Volumes +#from ScoutSuite.providers.osc.resources.api.vpcs import Vpcs +#from ScoutSuite.providers.osc.resources.api.instances import Instances +from ScoutSuite.providers.osc.resources.regions import Regions + + +class Api(Regions): + _children = [ + #(Vpcs, 'vpcs'), + #(Instances, 'instances'), + (Snapshots, 'snapshots'), + # (Volumes, 'volumes') + ] + + def __init__(self, facade): + super(Api, self).__init__('api', facade) + + async def fetch_all(self, regions=None, excluded_regions=None, partition_name='aws', **kwargs): + await super(Api, self).fetch_all(regions, excluded_regions, partition_name) + diff --git a/ScoutSuite/providers/osc/resources/api/instances.py b/ScoutSuite/providers/osc/resources/api/instances.py new file mode 100644 index 000000000..e69de29bb diff --git a/ScoutSuite/providers/osc/resources/api/snapshots.py b/ScoutSuite/providers/osc/resources/api/snapshots.py new file mode 100644 index 000000000..b417613da --- /dev/null +++ b/ScoutSuite/providers/osc/resources/api/snapshots.py @@ -0,0 +1,15 @@ +from ScoutSuite.providers.osc.resources.base import OSCResources +from ScoutSuite.providers.osc.facade.base import OSCFacade + + +class Snapshots(OSCResources): + + def __init__(self, facade: OSCFacade, region: str): + super(Snapshots, self).__init__(facade) + self.region = region + + async def fetch_all(self): + raw_snapshots = await self.facade.api.list_snapshots() + for raw_snapshot in raw_snapshots: + name, resource = self._parse_snapshot(raw_snapshot) + self[name] = resource \ No newline at end of file diff --git a/ScoutSuite/providers/osc/resources/api/volumes.py b/ScoutSuite/providers/osc/resources/api/volumes.py new file mode 100644 index 000000000..e69de29bb diff --git a/ScoutSuite/providers/osc/resources/api/vpcs.py b/ScoutSuite/providers/osc/resources/api/vpcs.py new file mode 100644 index 000000000..e69de29bb diff --git a/ScoutSuite/providers/osc/resources/base.py b/ScoutSuite/providers/osc/resources/base.py new file mode 100644 index 000000000..d68b8ee0f --- /dev/null +++ b/ScoutSuite/providers/osc/resources/base.py @@ -0,0 +1,16 @@ + +import abc + +from ScoutSuite.providers.base.resources.base import Resources, CompositeResources + + +class OSCResources(Resources, metaclass=abc.ABCMeta): + """This is the base class for OSC resources.""" + + pass + + +class OSCCompositeResources(OSCResources, CompositeResources, + metaclass=abc.ABCMeta): + + pass \ No newline at end of file diff --git a/ScoutSuite/providers/osc/resources/regions.py b/ScoutSuite/providers/osc/resources/regions.py new file mode 100644 index 000000000..2d8eebb82 --- /dev/null +++ b/ScoutSuite/providers/osc/resources/regions.py @@ -0,0 +1,26 @@ +import abc + +from ScoutSuite.providers.osc.resources.base import OSCCompositeResources +from ScoutSuite.providers.osc.facade.base import OSCFacade + + +class Regions(OSCCompositeResources, metaclass=abc.ABCMeta): + + def __init__(self, service: str, facade: OSCFacade): + super(Regions, self).__init__(facade) + self.service = service + + async def fetch_all(self, regions=None, excluded_regions=None, **kwargs): + self["region"] = {} + for region in await self.facade.build_region_list(self.service, + regions, excluded_regions): + self["region"][region] = { + 'id': region, + 'region': region, + 'name': region + } + await self._fetch_children_of_all_resources( + resources=self['regions'], + scopes={region: {'region': region} for region in self['regions']} + ) + self._set_counts() diff --git a/ScoutSuite/providers/osc/services.py b/ScoutSuite/providers/osc/services.py new file mode 100644 index 000000000..7384a553e --- /dev/null +++ b/ScoutSuite/providers/osc/services.py @@ -0,0 +1,22 @@ +from ScoutSuite.providers.base.services import BaseServicesConfig +from ScoutSuite.providers.osc.resources.api.base import Api +from ScoutSuite.providers.osc.facade.base import OSCFacade + + +class OSCServicesConfig(BaseServicesConfig): + """ + Object that holds the necessary OSC configuration for all services in + scope. + + :ivar api: API configuration + """ + def __init__(self, credentials=None, **kwargs): + + super(OSCServicesConfig, self).__init__(credentials) + + facade = OSCFacade(credentials) + + self.api = Api(facade) + + def _is_provider(self, provider_name): + return provider_name == 'osc' diff --git a/requirements.txt b/requirements.txt index a97848293..8664f5d0c 100755 --- a/requirements.txt +++ b/requirements.txt @@ -61,3 +61,6 @@ oss2>=2.8.0 # Oracle Cloud Infrastructure Provider oci>=2.2.4 + +# Outscale API +$ pip install https://github.com/outscale/osc-sdk-python/releases/download/0.9.15/osc_sdk_python-0.9.15-py3-none-any.whl From 1dd6626febd3ee39f54119e2e3213a4f4596c3bc Mon Sep 17 00:00:00 2001 From: Tio Gobin Date: Tue, 4 Aug 2020 16:54:29 +0200 Subject: [PATCH 02/21] resolved error in requirements.txt --- ScoutSuite/providers/osc/metadata.json | 1 + requirements.txt | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 ScoutSuite/providers/osc/metadata.json diff --git a/ScoutSuite/providers/osc/metadata.json b/ScoutSuite/providers/osc/metadata.json new file mode 100644 index 000000000..9e26dfeeb --- /dev/null +++ b/ScoutSuite/providers/osc/metadata.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 8664f5d0c..40289ef4d 100755 --- a/requirements.txt +++ b/requirements.txt @@ -63,4 +63,4 @@ oss2>=2.8.0 oci>=2.2.4 # Outscale API -$ pip install https://github.com/outscale/osc-sdk-python/releases/download/0.9.15/osc_sdk_python-0.9.15-py3-none-any.whl +https://github.com/outscale/osc-sdk-python/releases/download/0.9.15/osc_sdk_python-0.9.15-py3-none-any.whl From 90bcb6528ba7a4c76807dc61e6faed58b06da4fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Tue, 4 Aug 2020 17:24:55 +0200 Subject: [PATCH 03/21] Fix typo --- ScoutSuite/providers/osc/facade/api.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ScoutSuite/providers/osc/facade/api.py b/ScoutSuite/providers/osc/facade/api.py index 2ce6c68b0..e839f2231 100644 --- a/ScoutSuite/providers/osc/facade/api.py +++ b/ScoutSuite/providers/osc/facade/api.py @@ -7,7 +7,7 @@ class ApiFacade(OSCBaseFacade): def __init__(self, session: Gateway): - super(ApiFacade, self).init(session) + super(ApiFacade, self).__init__(session) async def get_instances(self, region: str): try: From 1738587252df670a70a84d34694e365b051be5f5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Wed, 5 Aug 2020 10:44:53 +0200 Subject: [PATCH 04/21] Add osc_access_key and osc_secret_access_key parameters, move partition_name from position parameter to named --- ScoutSuite/__main__.py | 10 +++++++++- ScoutSuite/providers/osc/resources/api/base.py | 2 +- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/ScoutSuite/__main__.py b/ScoutSuite/__main__.py index df04aa049..41ad0384a 100755 --- a/ScoutSuite/__main__.py +++ b/ScoutSuite/__main__.py @@ -53,6 +53,9 @@ def run_from_cli(): organization_id=args.get('organization_id'), all_projects=args.get('all_projects'), # Aliyun access_key_id=args.get('access_key_id'), access_key_secret=args.get('access_key_secret'), + # Outscale + osc_access_key=args.get('osc_access_key'), + osc_secret_access_key=args.get('osc_secret_access_key'), # General report_name=args.get('report_name'), report_dir=args.get('report_dir'), timestamp=args.get('timestamp'), @@ -151,6 +154,9 @@ async def _run(provider, project_id, folder_id, organization_id, all_projects, # Aliyun access_key_id, access_key_secret, + # Outscale + osc_access_key, + osc_secret_access_key, # General report_name, report_dir, timestamp, @@ -198,7 +204,9 @@ async def _run(provider, username=username, password=password, access_key_id=access_key_id, - access_key_secret=access_key_secret) + access_key_secret=access_key_secret, + osc_access_key=osc_access_key, + osc_secret_access_key=osc_secret_access_key) if not credentials: return 101 diff --git a/ScoutSuite/providers/osc/resources/api/base.py b/ScoutSuite/providers/osc/resources/api/base.py index b8a4c6500..aee132063 100644 --- a/ScoutSuite/providers/osc/resources/api/base.py +++ b/ScoutSuite/providers/osc/resources/api/base.py @@ -17,5 +17,5 @@ def __init__(self, facade): super(Api, self).__init__('api', facade) async def fetch_all(self, regions=None, excluded_regions=None, partition_name='aws', **kwargs): - await super(Api, self).fetch_all(regions, excluded_regions, partition_name) + await super(Api, self).fetch_all(regions, excluded_regions, partition_name=partition_name) From dbbd323682805ed7397e573a9fcffa34f50f5c26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Wed, 5 Aug 2020 10:49:54 +0200 Subject: [PATCH 05/21] Fix run()'s prototype --- ScoutSuite/__main__.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ScoutSuite/__main__.py b/ScoutSuite/__main__.py index 41ad0384a..351638829 100755 --- a/ScoutSuite/__main__.py +++ b/ScoutSuite/__main__.py @@ -102,6 +102,8 @@ def run(provider, project_id=None, folder_id=None, organization_id=None, all_projects=False, # Aliyun access_key_id=None, access_key_secret=None, + # Outscale + osc_access_key=None, osc_secret_access_key=None, # General report_name=None, report_dir=None, timestamp=False, From 155ce5a97182cd3388c7aabdea3ea2167ba2a45d Mon Sep 17 00:00:00 2001 From: Tio Gobin Date: Wed, 5 Aug 2020 11:18:29 +0200 Subject: [PATCH 06/21] Solved issue concerning provider account_id --- .../providers/osc/authentication_strategy.py | 132 ------------------ ScoutSuite/providers/osc/facade/base.py | 2 +- ScoutSuite/providers/osc/facade/utils.py | 3 - ScoutSuite/providers/osc/provider.py | 2 +- 4 files changed, 2 insertions(+), 137 deletions(-) diff --git a/ScoutSuite/providers/osc/authentication_strategy.py b/ScoutSuite/providers/osc/authentication_strategy.py index 380bf88e4..db4c7b56a 100644 --- a/ScoutSuite/providers/osc/authentication_strategy.py +++ b/ScoutSuite/providers/osc/authentication_strategy.py @@ -23,138 +23,6 @@ from ScoutSuite.providers.base.authentication_strategy import AuthenticationStrategy, AuthenticationException from osc_sdk_python import Gateway -__all__ = [ - 'OSCRequestSignerAlgorithmV4', -] - - -class OSCRequestSigner(object): - """ - Class which handles signing the outgoing AWS requests. - """ - - def __init__(self, access_key, access_secret, version="latest", - connection=None): - """ - :param access_key: Access key. - :type access_key: ``str`` - - :param access_secret: Access secret. - :type access_secret: ``str`` - - :param version: API version. - :type version: ``str`` - - :param connection: Connection instance. - :type connection: :class:`Connection` - """ - self.access_key = access_key - self.access_secret = access_secret - self.version = version - self.connection = connection - - -class OSCRequestSignerAlgorithmV4(OSCRequestSigner): - @staticmethod - def sign(key, msg): - return hmac.new(key, msg.encode("utf-8"), hashlib.sha256).digest() - - @staticmethod - def _get_signed_headers(headers): - return ';'.join([k.lower() for k in sorted(headers.keys())]) - - @staticmethod - def _get_canonical_headers(headers): - return '\n'.join([':'.join([k.lower(), str(v).strip()]) - for k, v in sorted(headers.items())]) + '\n' - - @staticmethod - def _get_request_params(params): - return '&'.join(["%s=%s" % - (urlquote(k, safe=''), urlquote(str(v), safe='~')) - for k, v in sorted(params.items())]) - - def get_request_headers(self, service_name, region, action, - data=None): - date = datetime.utcnow() - host = "{}.{}.outscale.com".format(service_name, region) - headers = { - 'Content-Type': "application/json; charset=utf-8", - 'X-Osc-Date': date.strftime('%Y%m%dT%H%M%SZ'), - 'Host': host, - } - path = "/{}/{}/{}".format( - service_name, - self.version, - action - ) - sig = self._get_authorization_v4_header( - headers=headers, - dt=date, - method='POST', - path=path, - data=data - ) - headers.update({'Authorization': sig}) - return headers - - def _get_authorization_v4_header(self, headers, dt, method='GET', - path='/', data=None): - credentials_scope = self._get_credential_scope(dt=dt) - signed_headers = self._get_signed_headers(headers=headers) - signature = self._get_signature(headers=headers, dt=dt, - method=method, path=path, - data=data) - return 'OSC4-HMAC-SHA256 Credential=%(u)s/%(c)s, ' \ - 'SignedHeaders=%(sh)s, Signature=%(s)s' % { - 'u': self.access_key, - 'c': credentials_scope, - 'sh': signed_headers, - 's': signature - } - - def _get_signature(self, headers, dt, method, path, data): - string_to_sign = self._get_string_to_sign(headers=headers, dt=dt, - method=method, path=path, - data=data) - signing_key = self._get_key_to_sign_with(self.access_secret, dt) - return hmac.new(signing_key, string_to_sign.encode('utf-8'), - hashlib.sha256).hexdigest() - - def _get_key_to_sign_with(self, key, dt): - dt = dt.strftime('%Y%m%d') - k_date = self.sign(('OSC4' + key).encode('utf-8'), dt) - k_region = self.sign(k_date, self.connection.region_name) - k_service = self.sign(k_region, self.connection.service_name) - return self.sign(k_service, 'osc4_request') - - def _get_string_to_sign(self, headers, dt, method, path, data): - canonical_request = self._get_canonical_request(headers=headers, - method=method, - path=path, - data=data) - return 'OSC4-HMAC-SHA256' + '\n' \ - + dt.strftime('%Y%m%dT%H%M%SZ') + '\n' \ - + self._get_credential_scope(dt) + '\n' \ - + hashlib.sha256(canonical_request.encode('utf-8')).hexdigest() - - def _get_credential_scope(self, dt): - return '/'.join([dt.strftime('%Y%m%d'), - self.connection.region_name, - self.connection.service_name, - 'osc4_request']) - - def _get_canonical_request(self, headers, method, path, data="{}"): - data = data if data else "{}" - return '\n'.join([ - method, - path, - self._get_request_params({}), - self._get_canonical_headers(headers), - self._get_signed_headers(headers), - hashlib.sha256(data.encode('utf-8')).hexdigest() - ]) - class OutscaleAuthenticationStrategy(AuthenticationStrategy): def authenticate(self, profile=None, osc_access_key=None, diff --git a/ScoutSuite/providers/osc/facade/base.py b/ScoutSuite/providers/osc/facade/base.py index 2d621ce0d..f67203341 100644 --- a/ScoutSuite/providers/osc/facade/base.py +++ b/ScoutSuite/providers/osc/facade/base.py @@ -10,7 +10,7 @@ def __init__(self, credentials=None): async def build_region_list(self, service: str, chosen_regions=None, excluded_regions=None, partition_name='osc'): - region = self.session.list_locations() + region = self.session.ReadSubregions() def _instantiate_facades(self): self.api = ApiFacade(self.session) \ No newline at end of file diff --git a/ScoutSuite/providers/osc/facade/utils.py b/ScoutSuite/providers/osc/facade/utils.py index a2a27ab1a..e240dafd7 100644 --- a/ScoutSuite/providers/osc/facade/utils.py +++ b/ScoutSuite/providers/osc/facade/utils.py @@ -1,9 +1,6 @@ import json import requests -from ScoutSuite.providers.osc.authentication_strategy import \ - OSCRequestSignerAlgorithmV4 - class OSCFacadeUtils: @staticmethod diff --git a/ScoutSuite/providers/osc/provider.py b/ScoutSuite/providers/osc/provider.py index 074e6d3a6..4acb2e1cf 100644 --- a/ScoutSuite/providers/osc/provider.py +++ b/ScoutSuite/providers/osc/provider.py @@ -29,7 +29,7 @@ def __init__(self, profile='default', report_dir=None, timestamp=None, self.result_format = result_format self.credentials = kwargs['credentials'] - + self.account_id = "" super(OutscaleProvider, self).__init__(report_dir, timestamp, services, skipped_services, result_format) From e2cffca84c18e532b7295832f0e02ef7a23bb52f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Wed, 5 Aug 2020 16:01:52 +0200 Subject: [PATCH 07/21] WIP OSC --- .../partials/osc/left_menu_for_region.html | 34 +++++++ .../html/partials/osc/left_menu_for_vpc.html | 40 ++++++++ .../services.acm.regions.id.certificates.html | 94 +++++++++++++++++++ ...rvices.awslambda.regions.id.functions.html | 36 +++++++ ...ices.cloudformation.regions.id.stacks.html | 54 +++++++++++ .../osc/services.cloudtrail.regions.html | 37 ++++++++ ...services.cloudtrail.regions.id.trails.html | 46 +++++++++ ...services.cloudwatch.regions.id.alarms.html | 47 ++++++++++ .../partials/osc/services.config.regions.html | 51 ++++++++++ .../services.config.regions.id.recorders.html | 29 ++++++ .../osc/services.config.regions.id.rules.html | 30 ++++++ .../services.ec2.regions.id.snapshots.html | 24 +++++ .../osc/services.ec2.regions.id.volumes.html | 23 +++++ ...ervices.ec2.regions.id.vpcs.id.images.html | 27 ++++++ ...ices.ec2.regions.id.vpcs.id.instances.html | 72 ++++++++++++++ ...c2.regions.id.vpcs.id.security_groups.html | 48 ++++++++++ ...ns.vpcs.security_groups.resource_list.html | 33 +++++++ ...egions.vpcs.security_groups.rule_list.html | 46 +++++++++ ...asticache.regions.id.parameter_groups.html | 14 +++ ...lasticache.regions.id.security_groups.html | 14 +++ ....elasticache.regions.id.subnet_groups.html | 14 +++ ...asticache.regions.id.vpcs.id.clusters.html | 15 +++ .../services.elb.regions.id.elb_policies.html | 53 +++++++++++ .../services.elb.regions.id.vpcs.id.elbs.html | 87 +++++++++++++++++ ...ions.id.vpcs.id.elbs.linked_resources.html | 27 ++++++ ....elb.regions.id.vpcs.id.elbs.listener.html | 8 ++ ....regions.id.vpcsid.elbs.linked_policy.html | 9 ++ ...services.elbv2.regions.id.vpcs.id.lbs.html | 79 ++++++++++++++++ ...vices.emr.regions.id.vpcs.id.clusters.html | 60 ++++++++++++ .../osc/services.iam.credential_reports.html | 33 +++++++ .../partials/osc/services.iam.groups.html | 37 ++++++++ .../osc/services.iam.inline_policies.html | 17 ++++ .../osc/services.iam.managed_policies.html | 35 +++++++ .../services.iam.managed_policies_list.html | 15 +++ .../html/partials/osc/services.iam.roles.html | 51 ++++++++++ .../html/partials/osc/services.iam.users.html | 67 +++++++++++++ .../osc/services.kms.regions.id.keys.html | 52 ++++++++++ ...vices.rds.regions.id.parameter_groups.html | 40 ++++++++ ...rvices.rds.regions.id.security_groups.html | 28 ++++++ ...ices.rds.regions.id.vpcs.id.instances.html | 44 +++++++++ ...ices.rds.regions.id.vpcs.id.snapshots.html | 37 ++++++++ ....rds.regions.id.vpcs.id.subnet_groups.html | 15 +++ ....redshift.regions.id.parameter_groups.html | 27 ++++++ ....redshift.regions.id.vpcs.id.clusters.html | 51 ++++++++++ ...ft.regions.id.vpcs.id.security_groups.html | 35 +++++++ ...s.redshift.regions.vpcs.cluster_nodes.html | 9 ++ .../services.route53.regions.id.domains.html | 34 +++++++ ...vices.route53.regions.id.hosted_zones.html | 24 +++++ .../html/partials/osc/services.s3.acls.html | 58 ++++++++++++ .../osc/services.s3.bucket_iam_policies.html | 55 +++++++++++ .../partials/osc/services.s3.buckets.html | 77 +++++++++++++++ .../osc/services.s3.buckets.objects.html | 31 ++++++ ....s3.public_access_block_configuration.html | 22 +++++ ...ces.secretsmanager.regions.id.secrets.html | 25 +++++ .../services.ses.regions.id.identities.html | 29 ++++++ .../osc/services.sns.regions.id.topics.html | 62 ++++++++++++ .../osc/services.sqs.regions.id.queues.html | 34 +++++++ .../services.stackdriverlogging.sinks.html | 25 +++++ ...es.vpc.regions.id.peering_connections.html | 47 ++++++++++ .../osc/services.vpc.regions.id.vpcs.html | 66 +++++++++++++ ...ices.vpc.regions.id.vpcs.id.flow_logs.html | 29 ++++++ ...s.vpc.regions.id.vpcs.id.network_acls.html | 65 +++++++++++++ ...egions.id.vpcs.id.peering_connections.html | 12 +++ ...rvices.vpc.regions.id.vpcs.id.subnets.html | 54 +++++++++++ .../summaries/osc/left_menu_for_region.html | 34 +++++++ .../html/summaries/osc/left_menu_for_vpc.html | 40 ++++++++ .../services.acm.regions.id.certificates.html | 94 +++++++++++++++++++ ...rvices.awslambda.regions.id.functions.html | 36 +++++++ ...ices.cloudformation.regions.id.stacks.html | 54 +++++++++++ .../osc/services.cloudtrail.regions.html | 37 ++++++++ ...services.cloudtrail.regions.id.trails.html | 46 +++++++++ ...services.cloudwatch.regions.id.alarms.html | 47 ++++++++++ .../osc/services.config.regions.html | 51 ++++++++++ .../services.config.regions.id.recorders.html | 29 ++++++ .../osc/services.config.regions.id.rules.html | 30 ++++++ .../services.ec2.regions.id.snapshots.html | 24 +++++ .../osc/services.ec2.regions.id.volumes.html | 23 +++++ ...ervices.ec2.regions.id.vpcs.id.images.html | 27 ++++++ ...ices.ec2.regions.id.vpcs.id.instances.html | 72 ++++++++++++++ ...c2.regions.id.vpcs.id.security_groups.html | 48 ++++++++++ ...ns.vpcs.security_groups.resource_list.html | 33 +++++++ ...egions.vpcs.security_groups.rule_list.html | 46 +++++++++ ...asticache.regions.id.parameter_groups.html | 14 +++ ...lasticache.regions.id.security_groups.html | 14 +++ ....elasticache.regions.id.subnet_groups.html | 14 +++ ...asticache.regions.id.vpcs.id.clusters.html | 15 +++ .../services.elb.regions.id.elb_policies.html | 53 +++++++++++ .../services.elb.regions.id.vpcs.id.elbs.html | 87 +++++++++++++++++ ...ions.id.vpcs.id.elbs.linked_resources.html | 27 ++++++ ....elb.regions.id.vpcs.id.elbs.listener.html | 8 ++ ....regions.id.vpcsid.elbs.linked_policy.html | 9 ++ ...services.elbv2.regions.id.vpcs.id.lbs.html | 79 ++++++++++++++++ ...vices.emr.regions.id.vpcs.id.clusters.html | 60 ++++++++++++ .../osc/services.iam.credential_reports.html | 33 +++++++ .../summaries/osc/services.iam.groups.html | 37 ++++++++ .../osc/services.iam.inline_policies.html | 17 ++++ .../osc/services.iam.managed_policies.html | 35 +++++++ .../services.iam.managed_policies_list.html | 15 +++ .../summaries/osc/services.iam.roles.html | 51 ++++++++++ .../summaries/osc/services.iam.users.html | 67 +++++++++++++ .../osc/services.kms.regions.id.keys.html | 52 ++++++++++ ...vices.rds.regions.id.parameter_groups.html | 40 ++++++++ ...rvices.rds.regions.id.security_groups.html | 28 ++++++ ...ices.rds.regions.id.vpcs.id.instances.html | 44 +++++++++ ...ices.rds.regions.id.vpcs.id.snapshots.html | 37 ++++++++ ....rds.regions.id.vpcs.id.subnet_groups.html | 15 +++ ....redshift.regions.id.parameter_groups.html | 27 ++++++ ....redshift.regions.id.vpcs.id.clusters.html | 51 ++++++++++ ...ft.regions.id.vpcs.id.security_groups.html | 35 +++++++ ...s.redshift.regions.vpcs.cluster_nodes.html | 9 ++ .../services.route53.regions.id.domains.html | 34 +++++++ ...vices.route53.regions.id.hosted_zones.html | 24 +++++ .../html/summaries/osc/services.s3.acls.html | 58 ++++++++++++ .../osc/services.s3.bucket_iam_policies.html | 55 +++++++++++ .../summaries/osc/services.s3.buckets.html | 77 +++++++++++++++ .../osc/services.s3.buckets.objects.html | 31 ++++++ ....s3.public_access_block_configuration.html | 22 +++++ ...ces.secretsmanager.regions.id.secrets.html | 25 +++++ .../services.ses.regions.id.identities.html | 29 ++++++ .../osc/services.sns.regions.id.topics.html | 62 ++++++++++++ .../osc/services.sqs.regions.id.queues.html | 34 +++++++ .../services.stackdriverlogging.sinks.html | 25 +++++ ...es.vpc.regions.id.peering_connections.html | 47 ++++++++++ .../osc/services.vpc.regions.id.vpcs.html | 66 +++++++++++++ ...ices.vpc.regions.id.vpcs.id.flow_logs.html | 29 ++++++ ...s.vpc.regions.id.vpcs.id.network_acls.html | 65 +++++++++++++ ...egions.id.vpcs.id.peering_connections.html | 12 +++ ...rvices.vpc.regions.id.vpcs.id.subnets.html | 54 +++++++++++ ScoutSuite/providers/osc/facade/basefacade.py | 3 +- .../security-group-opens-all-ports.json | 9 ++ .../fcu-security-group-opens-all-ports.json | 15 +++ .../providers/osc/rules/rulesets/default.json | 11 +++ .../providers/osc/rules/rulesets/filters.json | 4 + 133 files changed, 5027 insertions(+), 1 deletion(-) create mode 100755 ScoutSuite/output/data/html/partials/osc/left_menu_for_region.html create mode 100755 ScoutSuite/output/data/html/partials/osc/left_menu_for_vpc.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.acm.regions.id.certificates.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.awslambda.regions.id.functions.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.cloudformation.regions.id.stacks.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.cloudtrail.regions.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.cloudtrail.regions.id.trails.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.cloudwatch.regions.id.alarms.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.config.regions.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.config.regions.id.recorders.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.config.regions.id.rules.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.snapshots.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.volumes.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.images.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.instances.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.security_groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.ec2.regions.vpcs.security_groups.resource_list.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.ec2.regions.vpcs.security_groups.rule_list.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.parameter_groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.security_groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.subnet_groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.vpcs.id.clusters.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.elb_policies.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.linked_resources.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.listener.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcsid.elbs.linked_policy.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.elbv2.regions.id.vpcs.id.lbs.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.emr.regions.id.vpcs.id.clusters.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.iam.credential_reports.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.iam.groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.iam.inline_policies.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.iam.managed_policies.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.iam.managed_policies_list.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.iam.roles.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.iam.users.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.kms.regions.id.keys.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.parameter_groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.security_groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.instances.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.snapshots.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.subnet_groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.parameter_groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.vpcs.id.clusters.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.vpcs.id.security_groups.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.redshift.regions.vpcs.cluster_nodes.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.route53.regions.id.domains.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.route53.regions.id.hosted_zones.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.s3.acls.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.s3.bucket_iam_policies.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.s3.buckets.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.s3.buckets.objects.html create mode 100644 ScoutSuite/output/data/html/partials/osc/services.s3.public_access_block_configuration.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.secretsmanager.regions.id.secrets.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.ses.regions.id.identities.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.sns.regions.id.topics.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.sqs.regions.id.queues.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.stackdriverlogging.sinks.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.peering_connections.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.flow_logs.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.network_acls.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.peering_connections.html create mode 100755 ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.subnets.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/left_menu_for_region.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/left_menu_for_vpc.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.acm.regions.id.certificates.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.awslambda.regions.id.functions.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.cloudformation.regions.id.stacks.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.cloudtrail.regions.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.cloudtrail.regions.id.trails.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.cloudwatch.regions.id.alarms.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.config.regions.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.config.regions.id.recorders.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.config.regions.id.rules.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.snapshots.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.volumes.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.images.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.instances.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.security_groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.vpcs.security_groups.resource_list.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.vpcs.security_groups.rule_list.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.parameter_groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.security_groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.subnet_groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.vpcs.id.clusters.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.elb_policies.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.linked_resources.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.listener.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcsid.elbs.linked_policy.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.elbv2.regions.id.vpcs.id.lbs.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.emr.regions.id.vpcs.id.clusters.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.iam.credential_reports.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.iam.groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.iam.inline_policies.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.iam.managed_policies.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.iam.managed_policies_list.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.iam.roles.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.iam.users.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.kms.regions.id.keys.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.parameter_groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.security_groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.instances.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.snapshots.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.subnet_groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.parameter_groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.vpcs.id.clusters.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.vpcs.id.security_groups.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.vpcs.cluster_nodes.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.route53.regions.id.domains.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.route53.regions.id.hosted_zones.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.s3.acls.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.s3.bucket_iam_policies.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.s3.buckets.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.s3.buckets.objects.html create mode 100644 ScoutSuite/output/data/html/summaries/osc/services.s3.public_access_block_configuration.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.secretsmanager.regions.id.secrets.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.ses.regions.id.identities.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.sns.regions.id.topics.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.sqs.regions.id.queues.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.stackdriverlogging.sinks.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.peering_connections.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.flow_logs.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.network_acls.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.peering_connections.html create mode 100755 ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.subnets.html create mode 100644 ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json create mode 100755 ScoutSuite/providers/osc/rules/findings/fcu-security-group-opens-all-ports.json create mode 100644 ScoutSuite/providers/osc/rules/rulesets/default.json create mode 100644 ScoutSuite/providers/osc/rules/rulesets/filters.json diff --git a/ScoutSuite/output/data/html/partials/osc/left_menu_for_region.html b/ScoutSuite/output/data/html/partials/osc/left_menu_for_region.html new file mode 100755 index 000000000..bc7e796c5 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/left_menu_for_region.html @@ -0,0 +1,34 @@ + + + diff --git a/ScoutSuite/output/data/html/partials/osc/left_menu_for_vpc.html b/ScoutSuite/output/data/html/partials/osc/left_menu_for_vpc.html new file mode 100755 index 000000000..98a3e7c74 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/left_menu_for_vpc.html @@ -0,0 +1,40 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.acm.regions.id.certificates.html b/ScoutSuite/output/data/html/partials/osc/services.acm.regions.id.certificates.html new file mode 100755 index 000000000..35e2da561 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.acm.regions.id.certificates.html @@ -0,0 +1,94 @@ + + + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.awslambda.regions.id.functions.html b/ScoutSuite/output/data/html/partials/osc/services.awslambda.regions.id.functions.html new file mode 100755 index 000000000..4fe3b8b43 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.awslambda.regions.id.functions.html @@ -0,0 +1,36 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.cloudformation.regions.id.stacks.html b/ScoutSuite/output/data/html/partials/osc/services.cloudformation.regions.id.stacks.html new file mode 100755 index 000000000..35543762e --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.cloudformation.regions.id.stacks.html @@ -0,0 +1,54 @@ + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/partials/osc/services.cloudtrail.regions.html b/ScoutSuite/output/data/html/partials/osc/services.cloudtrail.regions.html new file mode 100755 index 000000000..07356891b --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.cloudtrail.regions.html @@ -0,0 +1,37 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.cloudtrail.regions.id.trails.html b/ScoutSuite/output/data/html/partials/osc/services.cloudtrail.regions.id.trails.html new file mode 100755 index 000000000..802499383 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.cloudtrail.regions.id.trails.html @@ -0,0 +1,46 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.cloudwatch.regions.id.alarms.html b/ScoutSuite/output/data/html/partials/osc/services.cloudwatch.regions.id.alarms.html new file mode 100755 index 000000000..90f7071b8 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.cloudwatch.regions.id.alarms.html @@ -0,0 +1,47 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.config.regions.html b/ScoutSuite/output/data/html/partials/osc/services.config.regions.html new file mode 100755 index 000000000..9c59be20b --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.config.regions.html @@ -0,0 +1,51 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.config.regions.id.recorders.html b/ScoutSuite/output/data/html/partials/osc/services.config.regions.id.recorders.html new file mode 100755 index 000000000..6173551b3 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.config.regions.id.recorders.html @@ -0,0 +1,29 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.config.regions.id.rules.html b/ScoutSuite/output/data/html/partials/osc/services.config.regions.id.rules.html new file mode 100755 index 000000000..a68a077fc --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.config.regions.id.rules.html @@ -0,0 +1,30 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.snapshots.html b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.snapshots.html new file mode 100755 index 000000000..bf03d8966 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.snapshots.html @@ -0,0 +1,24 @@ + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.volumes.html b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.volumes.html new file mode 100755 index 000000000..c1e6a113c --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.volumes.html @@ -0,0 +1,23 @@ + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.images.html b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.images.html new file mode 100755 index 000000000..5053fe8d5 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.images.html @@ -0,0 +1,27 @@ + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.instances.html b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.instances.html new file mode 100755 index 000000000..1ec325fc5 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.instances.html @@ -0,0 +1,72 @@ + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.security_groups.html b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.security_groups.html new file mode 100755 index 000000000..903ca2f17 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.id.vpcs.id.security_groups.html @@ -0,0 +1,48 @@ + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.vpcs.security_groups.resource_list.html b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.vpcs.security_groups.resource_list.html new file mode 100755 index 000000000..a55a94856 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.vpcs.security_groups.resource_list.html @@ -0,0 +1,33 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.vpcs.security_groups.rule_list.html b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.vpcs.security_groups.rule_list.html new file mode 100755 index 000000000..7fc22077a --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.ec2.regions.vpcs.security_groups.rule_list.html @@ -0,0 +1,46 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.parameter_groups.html b/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.parameter_groups.html new file mode 100755 index 000000000..90590d477 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.parameter_groups.html @@ -0,0 +1,14 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.security_groups.html b/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.security_groups.html new file mode 100755 index 000000000..d10d0cebb --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.security_groups.html @@ -0,0 +1,14 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.subnet_groups.html b/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.subnet_groups.html new file mode 100755 index 000000000..d362bf2fa --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.subnet_groups.html @@ -0,0 +1,14 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.vpcs.id.clusters.html b/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.vpcs.id.clusters.html new file mode 100755 index 000000000..f8f176eb1 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elasticache.regions.id.vpcs.id.clusters.html @@ -0,0 +1,15 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.elb_policies.html b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.elb_policies.html new file mode 100755 index 000000000..0cac00d38 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.elb_policies.html @@ -0,0 +1,53 @@ + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.html b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.html new file mode 100755 index 000000000..e197e1978 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.html @@ -0,0 +1,87 @@ + + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.linked_resources.html b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.linked_resources.html new file mode 100755 index 000000000..fb0d63843 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.linked_resources.html @@ -0,0 +1,27 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.listener.html b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.listener.html new file mode 100755 index 000000000..800062038 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcs.id.elbs.listener.html @@ -0,0 +1,8 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcsid.elbs.linked_policy.html b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcsid.elbs.linked_policy.html new file mode 100755 index 000000000..d6e4ecb47 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elb.regions.id.vpcsid.elbs.linked_policy.html @@ -0,0 +1,9 @@ + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/partials/osc/services.elbv2.regions.id.vpcs.id.lbs.html b/ScoutSuite/output/data/html/partials/osc/services.elbv2.regions.id.vpcs.id.lbs.html new file mode 100755 index 000000000..c13169c71 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.elbv2.regions.id.vpcs.id.lbs.html @@ -0,0 +1,79 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.emr.regions.id.vpcs.id.clusters.html b/ScoutSuite/output/data/html/partials/osc/services.emr.regions.id.vpcs.id.clusters.html new file mode 100755 index 000000000..40fd32370 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.emr.regions.id.vpcs.id.clusters.html @@ -0,0 +1,60 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.iam.credential_reports.html b/ScoutSuite/output/data/html/partials/osc/services.iam.credential_reports.html new file mode 100755 index 000000000..7751382dc --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.iam.credential_reports.html @@ -0,0 +1,33 @@ + + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.iam.groups.html b/ScoutSuite/output/data/html/partials/osc/services.iam.groups.html new file mode 100755 index 000000000..33cffce72 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.iam.groups.html @@ -0,0 +1,37 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.iam.inline_policies.html b/ScoutSuite/output/data/html/partials/osc/services.iam.inline_policies.html new file mode 100755 index 000000000..1f9168586 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.iam.inline_policies.html @@ -0,0 +1,17 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.iam.managed_policies.html b/ScoutSuite/output/data/html/partials/osc/services.iam.managed_policies.html new file mode 100755 index 000000000..401554aee --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.iam.managed_policies.html @@ -0,0 +1,35 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.iam.managed_policies_list.html b/ScoutSuite/output/data/html/partials/osc/services.iam.managed_policies_list.html new file mode 100755 index 000000000..9c1387309 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.iam.managed_policies_list.html @@ -0,0 +1,15 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.iam.roles.html b/ScoutSuite/output/data/html/partials/osc/services.iam.roles.html new file mode 100755 index 000000000..685fb67b5 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.iam.roles.html @@ -0,0 +1,51 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.iam.users.html b/ScoutSuite/output/data/html/partials/osc/services.iam.users.html new file mode 100755 index 000000000..f92b7450b --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.iam.users.html @@ -0,0 +1,67 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.kms.regions.id.keys.html b/ScoutSuite/output/data/html/partials/osc/services.kms.regions.id.keys.html new file mode 100755 index 000000000..a6d1cd8e4 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.kms.regions.id.keys.html @@ -0,0 +1,52 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.parameter_groups.html b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.parameter_groups.html new file mode 100755 index 000000000..4ce74d21d --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.parameter_groups.html @@ -0,0 +1,40 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.security_groups.html b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.security_groups.html new file mode 100755 index 000000000..dae872a30 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.security_groups.html @@ -0,0 +1,28 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.instances.html b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.instances.html new file mode 100755 index 000000000..b94d5945d --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.instances.html @@ -0,0 +1,44 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.snapshots.html b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.snapshots.html new file mode 100755 index 000000000..2a47efa8a --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.snapshots.html @@ -0,0 +1,37 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.subnet_groups.html b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.subnet_groups.html new file mode 100755 index 000000000..48d3f619d --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.rds.regions.id.vpcs.id.subnet_groups.html @@ -0,0 +1,15 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.parameter_groups.html b/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.parameter_groups.html new file mode 100755 index 000000000..db86abf53 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.parameter_groups.html @@ -0,0 +1,27 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.vpcs.id.clusters.html b/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.vpcs.id.clusters.html new file mode 100755 index 000000000..d29ce9e93 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.vpcs.id.clusters.html @@ -0,0 +1,51 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.vpcs.id.security_groups.html b/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.vpcs.id.security_groups.html new file mode 100755 index 000000000..1fddd79b8 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.id.vpcs.id.security_groups.html @@ -0,0 +1,35 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.vpcs.cluster_nodes.html b/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.vpcs.cluster_nodes.html new file mode 100755 index 000000000..d635a3a2b --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.redshift.regions.vpcs.cluster_nodes.html @@ -0,0 +1,9 @@ + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.route53.regions.id.domains.html b/ScoutSuite/output/data/html/partials/osc/services.route53.regions.id.domains.html new file mode 100755 index 000000000..b07936879 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.route53.regions.id.domains.html @@ -0,0 +1,34 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.route53.regions.id.hosted_zones.html b/ScoutSuite/output/data/html/partials/osc/services.route53.regions.id.hosted_zones.html new file mode 100755 index 000000000..52cd2d86e --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.route53.regions.id.hosted_zones.html @@ -0,0 +1,24 @@ + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/partials/osc/services.s3.acls.html b/ScoutSuite/output/data/html/partials/osc/services.s3.acls.html new file mode 100755 index 000000000..5c189875e --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.s3.acls.html @@ -0,0 +1,58 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.s3.bucket_iam_policies.html b/ScoutSuite/output/data/html/partials/osc/services.s3.bucket_iam_policies.html new file mode 100755 index 000000000..ba663aa65 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.s3.bucket_iam_policies.html @@ -0,0 +1,55 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.s3.buckets.html b/ScoutSuite/output/data/html/partials/osc/services.s3.buckets.html new file mode 100755 index 000000000..fcd20f393 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.s3.buckets.html @@ -0,0 +1,77 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.s3.buckets.objects.html b/ScoutSuite/output/data/html/partials/osc/services.s3.buckets.objects.html new file mode 100755 index 000000000..66bd76a30 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.s3.buckets.objects.html @@ -0,0 +1,31 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.s3.public_access_block_configuration.html b/ScoutSuite/output/data/html/partials/osc/services.s3.public_access_block_configuration.html new file mode 100644 index 000000000..df0787325 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.s3.public_access_block_configuration.html @@ -0,0 +1,22 @@ + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.secretsmanager.regions.id.secrets.html b/ScoutSuite/output/data/html/partials/osc/services.secretsmanager.regions.id.secrets.html new file mode 100755 index 000000000..caab24cb8 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.secretsmanager.regions.id.secrets.html @@ -0,0 +1,25 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.ses.regions.id.identities.html b/ScoutSuite/output/data/html/partials/osc/services.ses.regions.id.identities.html new file mode 100755 index 000000000..279e34961 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.ses.regions.id.identities.html @@ -0,0 +1,29 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.sns.regions.id.topics.html b/ScoutSuite/output/data/html/partials/osc/services.sns.regions.id.topics.html new file mode 100755 index 000000000..08c907ef1 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.sns.regions.id.topics.html @@ -0,0 +1,62 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.sqs.regions.id.queues.html b/ScoutSuite/output/data/html/partials/osc/services.sqs.regions.id.queues.html new file mode 100755 index 000000000..5390681b1 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.sqs.regions.id.queues.html @@ -0,0 +1,34 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.stackdriverlogging.sinks.html b/ScoutSuite/output/data/html/partials/osc/services.stackdriverlogging.sinks.html new file mode 100755 index 000000000..7ea2a9306 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.stackdriverlogging.sinks.html @@ -0,0 +1,25 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.peering_connections.html b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.peering_connections.html new file mode 100755 index 000000000..95acfd63e --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.peering_connections.html @@ -0,0 +1,47 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.html b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.html new file mode 100755 index 000000000..023de9a0c --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.html @@ -0,0 +1,66 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.flow_logs.html b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.flow_logs.html new file mode 100755 index 000000000..12cabd25f --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.flow_logs.html @@ -0,0 +1,29 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.network_acls.html b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.network_acls.html new file mode 100755 index 000000000..13aa84089 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.network_acls.html @@ -0,0 +1,65 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.peering_connections.html b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.peering_connections.html new file mode 100755 index 000000000..b5622fb43 --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.peering_connections.html @@ -0,0 +1,12 @@ + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.subnets.html b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.subnets.html new file mode 100755 index 000000000..345b4404c --- /dev/null +++ b/ScoutSuite/output/data/html/partials/osc/services.vpc.regions.id.vpcs.id.subnets.html @@ -0,0 +1,54 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/left_menu_for_region.html b/ScoutSuite/output/data/html/summaries/osc/left_menu_for_region.html new file mode 100755 index 000000000..bc7e796c5 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/left_menu_for_region.html @@ -0,0 +1,34 @@ + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/left_menu_for_vpc.html b/ScoutSuite/output/data/html/summaries/osc/left_menu_for_vpc.html new file mode 100755 index 000000000..98a3e7c74 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/left_menu_for_vpc.html @@ -0,0 +1,40 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.acm.regions.id.certificates.html b/ScoutSuite/output/data/html/summaries/osc/services.acm.regions.id.certificates.html new file mode 100755 index 000000000..35e2da561 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.acm.regions.id.certificates.html @@ -0,0 +1,94 @@ + + + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.awslambda.regions.id.functions.html b/ScoutSuite/output/data/html/summaries/osc/services.awslambda.regions.id.functions.html new file mode 100755 index 000000000..4fe3b8b43 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.awslambda.regions.id.functions.html @@ -0,0 +1,36 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.cloudformation.regions.id.stacks.html b/ScoutSuite/output/data/html/summaries/osc/services.cloudformation.regions.id.stacks.html new file mode 100755 index 000000000..35543762e --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.cloudformation.regions.id.stacks.html @@ -0,0 +1,54 @@ + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/summaries/osc/services.cloudtrail.regions.html b/ScoutSuite/output/data/html/summaries/osc/services.cloudtrail.regions.html new file mode 100755 index 000000000..07356891b --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.cloudtrail.regions.html @@ -0,0 +1,37 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.cloudtrail.regions.id.trails.html b/ScoutSuite/output/data/html/summaries/osc/services.cloudtrail.regions.id.trails.html new file mode 100755 index 000000000..802499383 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.cloudtrail.regions.id.trails.html @@ -0,0 +1,46 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.cloudwatch.regions.id.alarms.html b/ScoutSuite/output/data/html/summaries/osc/services.cloudwatch.regions.id.alarms.html new file mode 100755 index 000000000..90f7071b8 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.cloudwatch.regions.id.alarms.html @@ -0,0 +1,47 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.config.regions.html b/ScoutSuite/output/data/html/summaries/osc/services.config.regions.html new file mode 100755 index 000000000..9c59be20b --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.config.regions.html @@ -0,0 +1,51 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.config.regions.id.recorders.html b/ScoutSuite/output/data/html/summaries/osc/services.config.regions.id.recorders.html new file mode 100755 index 000000000..6173551b3 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.config.regions.id.recorders.html @@ -0,0 +1,29 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.config.regions.id.rules.html b/ScoutSuite/output/data/html/summaries/osc/services.config.regions.id.rules.html new file mode 100755 index 000000000..a68a077fc --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.config.regions.id.rules.html @@ -0,0 +1,30 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.snapshots.html b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.snapshots.html new file mode 100755 index 000000000..bf03d8966 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.snapshots.html @@ -0,0 +1,24 @@ + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.volumes.html b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.volumes.html new file mode 100755 index 000000000..c1e6a113c --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.volumes.html @@ -0,0 +1,23 @@ + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.images.html b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.images.html new file mode 100755 index 000000000..5053fe8d5 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.images.html @@ -0,0 +1,27 @@ + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.instances.html b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.instances.html new file mode 100755 index 000000000..1ec325fc5 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.instances.html @@ -0,0 +1,72 @@ + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.security_groups.html b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.security_groups.html new file mode 100755 index 000000000..903ca2f17 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.id.vpcs.id.security_groups.html @@ -0,0 +1,48 @@ + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.vpcs.security_groups.resource_list.html b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.vpcs.security_groups.resource_list.html new file mode 100755 index 000000000..a55a94856 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.vpcs.security_groups.resource_list.html @@ -0,0 +1,33 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.vpcs.security_groups.rule_list.html b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.vpcs.security_groups.rule_list.html new file mode 100755 index 000000000..7fc22077a --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.ec2.regions.vpcs.security_groups.rule_list.html @@ -0,0 +1,46 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.parameter_groups.html b/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.parameter_groups.html new file mode 100755 index 000000000..90590d477 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.parameter_groups.html @@ -0,0 +1,14 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.security_groups.html b/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.security_groups.html new file mode 100755 index 000000000..d10d0cebb --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.security_groups.html @@ -0,0 +1,14 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.subnet_groups.html b/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.subnet_groups.html new file mode 100755 index 000000000..d362bf2fa --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.subnet_groups.html @@ -0,0 +1,14 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.vpcs.id.clusters.html b/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.vpcs.id.clusters.html new file mode 100755 index 000000000..f8f176eb1 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elasticache.regions.id.vpcs.id.clusters.html @@ -0,0 +1,15 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.elb_policies.html b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.elb_policies.html new file mode 100755 index 000000000..0cac00d38 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.elb_policies.html @@ -0,0 +1,53 @@ + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.html b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.html new file mode 100755 index 000000000..e197e1978 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.html @@ -0,0 +1,87 @@ + + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.linked_resources.html b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.linked_resources.html new file mode 100755 index 000000000..fb0d63843 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.linked_resources.html @@ -0,0 +1,27 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.listener.html b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.listener.html new file mode 100755 index 000000000..800062038 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcs.id.elbs.listener.html @@ -0,0 +1,8 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcsid.elbs.linked_policy.html b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcsid.elbs.linked_policy.html new file mode 100755 index 000000000..d6e4ecb47 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elb.regions.id.vpcsid.elbs.linked_policy.html @@ -0,0 +1,9 @@ + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/summaries/osc/services.elbv2.regions.id.vpcs.id.lbs.html b/ScoutSuite/output/data/html/summaries/osc/services.elbv2.regions.id.vpcs.id.lbs.html new file mode 100755 index 000000000..c13169c71 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.elbv2.regions.id.vpcs.id.lbs.html @@ -0,0 +1,79 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.emr.regions.id.vpcs.id.clusters.html b/ScoutSuite/output/data/html/summaries/osc/services.emr.regions.id.vpcs.id.clusters.html new file mode 100755 index 000000000..40fd32370 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.emr.regions.id.vpcs.id.clusters.html @@ -0,0 +1,60 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.iam.credential_reports.html b/ScoutSuite/output/data/html/summaries/osc/services.iam.credential_reports.html new file mode 100755 index 000000000..7751382dc --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.iam.credential_reports.html @@ -0,0 +1,33 @@ + + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.iam.groups.html b/ScoutSuite/output/data/html/summaries/osc/services.iam.groups.html new file mode 100755 index 000000000..33cffce72 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.iam.groups.html @@ -0,0 +1,37 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.iam.inline_policies.html b/ScoutSuite/output/data/html/summaries/osc/services.iam.inline_policies.html new file mode 100755 index 000000000..1f9168586 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.iam.inline_policies.html @@ -0,0 +1,17 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.iam.managed_policies.html b/ScoutSuite/output/data/html/summaries/osc/services.iam.managed_policies.html new file mode 100755 index 000000000..401554aee --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.iam.managed_policies.html @@ -0,0 +1,35 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.iam.managed_policies_list.html b/ScoutSuite/output/data/html/summaries/osc/services.iam.managed_policies_list.html new file mode 100755 index 000000000..9c1387309 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.iam.managed_policies_list.html @@ -0,0 +1,15 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.iam.roles.html b/ScoutSuite/output/data/html/summaries/osc/services.iam.roles.html new file mode 100755 index 000000000..685fb67b5 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.iam.roles.html @@ -0,0 +1,51 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.iam.users.html b/ScoutSuite/output/data/html/summaries/osc/services.iam.users.html new file mode 100755 index 000000000..f92b7450b --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.iam.users.html @@ -0,0 +1,67 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.kms.regions.id.keys.html b/ScoutSuite/output/data/html/summaries/osc/services.kms.regions.id.keys.html new file mode 100755 index 000000000..a6d1cd8e4 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.kms.regions.id.keys.html @@ -0,0 +1,52 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.parameter_groups.html b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.parameter_groups.html new file mode 100755 index 000000000..4ce74d21d --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.parameter_groups.html @@ -0,0 +1,40 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.security_groups.html b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.security_groups.html new file mode 100755 index 000000000..dae872a30 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.security_groups.html @@ -0,0 +1,28 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.instances.html b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.instances.html new file mode 100755 index 000000000..b94d5945d --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.instances.html @@ -0,0 +1,44 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.snapshots.html b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.snapshots.html new file mode 100755 index 000000000..2a47efa8a --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.snapshots.html @@ -0,0 +1,37 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.subnet_groups.html b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.subnet_groups.html new file mode 100755 index 000000000..48d3f619d --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.rds.regions.id.vpcs.id.subnet_groups.html @@ -0,0 +1,15 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.parameter_groups.html b/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.parameter_groups.html new file mode 100755 index 000000000..db86abf53 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.parameter_groups.html @@ -0,0 +1,27 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.vpcs.id.clusters.html b/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.vpcs.id.clusters.html new file mode 100755 index 000000000..d29ce9e93 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.vpcs.id.clusters.html @@ -0,0 +1,51 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.vpcs.id.security_groups.html b/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.vpcs.id.security_groups.html new file mode 100755 index 000000000..1fddd79b8 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.id.vpcs.id.security_groups.html @@ -0,0 +1,35 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.vpcs.cluster_nodes.html b/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.vpcs.cluster_nodes.html new file mode 100755 index 000000000..d635a3a2b --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.redshift.regions.vpcs.cluster_nodes.html @@ -0,0 +1,9 @@ + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.route53.regions.id.domains.html b/ScoutSuite/output/data/html/summaries/osc/services.route53.regions.id.domains.html new file mode 100755 index 000000000..b07936879 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.route53.regions.id.domains.html @@ -0,0 +1,34 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.route53.regions.id.hosted_zones.html b/ScoutSuite/output/data/html/summaries/osc/services.route53.regions.id.hosted_zones.html new file mode 100755 index 000000000..52cd2d86e --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.route53.regions.id.hosted_zones.html @@ -0,0 +1,24 @@ + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/summaries/osc/services.s3.acls.html b/ScoutSuite/output/data/html/summaries/osc/services.s3.acls.html new file mode 100755 index 000000000..5c189875e --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.s3.acls.html @@ -0,0 +1,58 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.s3.bucket_iam_policies.html b/ScoutSuite/output/data/html/summaries/osc/services.s3.bucket_iam_policies.html new file mode 100755 index 000000000..ba663aa65 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.s3.bucket_iam_policies.html @@ -0,0 +1,55 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.s3.buckets.html b/ScoutSuite/output/data/html/summaries/osc/services.s3.buckets.html new file mode 100755 index 000000000..fcd20f393 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.s3.buckets.html @@ -0,0 +1,77 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.s3.buckets.objects.html b/ScoutSuite/output/data/html/summaries/osc/services.s3.buckets.objects.html new file mode 100755 index 000000000..66bd76a30 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.s3.buckets.objects.html @@ -0,0 +1,31 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.s3.public_access_block_configuration.html b/ScoutSuite/output/data/html/summaries/osc/services.s3.public_access_block_configuration.html new file mode 100644 index 000000000..df0787325 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.s3.public_access_block_configuration.html @@ -0,0 +1,22 @@ + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.secretsmanager.regions.id.secrets.html b/ScoutSuite/output/data/html/summaries/osc/services.secretsmanager.regions.id.secrets.html new file mode 100755 index 000000000..caab24cb8 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.secretsmanager.regions.id.secrets.html @@ -0,0 +1,25 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.ses.regions.id.identities.html b/ScoutSuite/output/data/html/summaries/osc/services.ses.regions.id.identities.html new file mode 100755 index 000000000..279e34961 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.ses.regions.id.identities.html @@ -0,0 +1,29 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.sns.regions.id.topics.html b/ScoutSuite/output/data/html/summaries/osc/services.sns.regions.id.topics.html new file mode 100755 index 000000000..08c907ef1 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.sns.regions.id.topics.html @@ -0,0 +1,62 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.sqs.regions.id.queues.html b/ScoutSuite/output/data/html/summaries/osc/services.sqs.regions.id.queues.html new file mode 100755 index 000000000..5390681b1 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.sqs.regions.id.queues.html @@ -0,0 +1,34 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.stackdriverlogging.sinks.html b/ScoutSuite/output/data/html/summaries/osc/services.stackdriverlogging.sinks.html new file mode 100755 index 000000000..7ea2a9306 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.stackdriverlogging.sinks.html @@ -0,0 +1,25 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.peering_connections.html b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.peering_connections.html new file mode 100755 index 000000000..95acfd63e --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.peering_connections.html @@ -0,0 +1,47 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.html b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.html new file mode 100755 index 000000000..023de9a0c --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.html @@ -0,0 +1,66 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.flow_logs.html b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.flow_logs.html new file mode 100755 index 000000000..12cabd25f --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.flow_logs.html @@ -0,0 +1,29 @@ + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.network_acls.html b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.network_acls.html new file mode 100755 index 000000000..13aa84089 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.network_acls.html @@ -0,0 +1,65 @@ + + + + + + + + + diff --git a/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.peering_connections.html b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.peering_connections.html new file mode 100755 index 000000000..b5622fb43 --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.peering_connections.html @@ -0,0 +1,12 @@ + + + + \ No newline at end of file diff --git a/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.subnets.html b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.subnets.html new file mode 100755 index 000000000..345b4404c --- /dev/null +++ b/ScoutSuite/output/data/html/summaries/osc/services.vpc.regions.id.vpcs.id.subnets.html @@ -0,0 +1,54 @@ + + + + + + + + diff --git a/ScoutSuite/providers/osc/facade/basefacade.py b/ScoutSuite/providers/osc/facade/basefacade.py index 84bec1c64..6c67e9f00 100644 --- a/ScoutSuite/providers/osc/facade/basefacade.py +++ b/ScoutSuite/providers/osc/facade/basefacade.py @@ -1,6 +1,7 @@ from osc_sdk_python import Gateway - +import logging class OSCBaseFacade(object): def __init__(self, session: Gateway = None): + logging.getLogger('scout').critical(f"Gateway :: {Gateway}") self.session = session diff --git a/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json b/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json new file mode 100644 index 000000000..26162fb65 --- /dev/null +++ b/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json @@ -0,0 +1,9 @@ +{ + "conditions": [ "and", + [ "or", + [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id.protocols.id.ports.id", "equal", "0-65535" ], + [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id.protocols.id", "equal", "ALL" ] + ], + [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id", "equal", "ingress"] + ] +} diff --git a/ScoutSuite/providers/osc/rules/findings/fcu-security-group-opens-all-ports.json b/ScoutSuite/providers/osc/rules/findings/fcu-security-group-opens-all-ports.json new file mode 100755 index 000000000..27b401976 --- /dev/null +++ b/ScoutSuite/providers/osc/rules/findings/fcu-security-group-opens-all-ports.json @@ -0,0 +1,15 @@ +{ + "description": "Security Group Opens All Ports", + "rationale": "It was detected that all ports in the security group are open, which creates a wider attack surface for resources assigned to it. Open ports should be reduced to the minimum needed to correctly operate.", + "dashboard_name": "Rules", + "display_path": "ec2.regions.id.vpcs.id.security_groups.id", + "path": "ec2.regions.id.vpcs.id.security_groups.id.rules.id.protocols.id.ports.id", + "conditions": [ + "and", + [ + "_INCLUDE_(conditions/security-group-opens-all-ports.json)", + "", + "" + ] + ] +} \ No newline at end of file diff --git a/ScoutSuite/providers/osc/rules/rulesets/default.json b/ScoutSuite/providers/osc/rules/rulesets/default.json new file mode 100644 index 000000000..93d36677f --- /dev/null +++ b/ScoutSuite/providers/osc/rules/rulesets/default.json @@ -0,0 +1,11 @@ +{ + "about": "This ruleset consists of numerous rules that are considered standard by NCC Group. The rules enabled range from violations of well-known security best practices to gaps resulting from less-known security implications of provider-specific mechanisms. Additional rules exist, some of them requiring extra-parameters to be configured, and some of them being applicable to a limited number of users.", + "rules": { + "fcu-security-group-opens-all-ports.json": [ + { + "enabled": true, + "level": "danger" + } + ] + } +} \ No newline at end of file diff --git a/ScoutSuite/providers/osc/rules/rulesets/filters.json b/ScoutSuite/providers/osc/rules/rulesets/filters.json new file mode 100644 index 000000000..156b33045 --- /dev/null +++ b/ScoutSuite/providers/osc/rules/rulesets/filters.json @@ -0,0 +1,4 @@ +{ + "rules": { + } +} \ No newline at end of file From 26da7609c95e8d46aad4907e155026d49d8caff8 Mon Sep 17 00:00:00 2001 From: Tio Gobin Date: Wed, 5 Aug 2020 16:44:13 +0200 Subject: [PATCH 08/21] build_regions_list in OSCFacade Working --- ScoutSuite/providers/osc/facade/base.py | 9 +++++++-- ScoutSuite/providers/osc/facade/utils.py | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/ScoutSuite/providers/osc/facade/base.py b/ScoutSuite/providers/osc/facade/base.py index f67203341..dee747113 100644 --- a/ScoutSuite/providers/osc/facade/base.py +++ b/ScoutSuite/providers/osc/facade/base.py @@ -1,6 +1,6 @@ from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade from ScoutSuite.providers.osc.facade.api import ApiFacade - +import requests class OSCFacade(OSCBaseFacade): def __init__(self, credentials=None): @@ -10,7 +10,12 @@ def __init__(self, credentials=None): async def build_region_list(self, service: str, chosen_regions=None, excluded_regions=None, partition_name='osc'): - region = self.session.ReadSubregions() + regions = requests.post( + "https://api.eu-west-2.outscale.com/api/latest/ReadRegions").json()["Regions"] + regions_list = [] + for region in regions: + regions_list.append(region["RegionName"]) + return regions def _instantiate_facades(self): self.api = ApiFacade(self.session) \ No newline at end of file diff --git a/ScoutSuite/providers/osc/facade/utils.py b/ScoutSuite/providers/osc/facade/utils.py index e240dafd7..f4bcfd3e2 100644 --- a/ScoutSuite/providers/osc/facade/utils.py +++ b/ScoutSuite/providers/osc/facade/utils.py @@ -5,7 +5,7 @@ class OSCFacadeUtils: @staticmethod def get_all_pages(self, session): - return session.ReadVms + return session.ReadVms() @staticmethod def _get_outscale_endpoint(region, version, action): return "https://api.{}.outscale.com/api/{}/{}".format( From 0000aee9f21f02c6b4bfd78bc006adf87b40a3d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Wed, 5 Aug 2020 16:46:59 +0200 Subject: [PATCH 09/21] Add __init__.py, create providers/osc/resources/fcu/ module --- ScoutSuite/providers/osc/facade/__init__.py | 0 ScoutSuite/providers/osc/resources/__init__.py | 0 ScoutSuite/providers/osc/resources/api/__init__.py | 0 ScoutSuite/providers/osc/resources/fcu/__init__.py | 0 4 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 ScoutSuite/providers/osc/facade/__init__.py create mode 100644 ScoutSuite/providers/osc/resources/__init__.py create mode 100644 ScoutSuite/providers/osc/resources/api/__init__.py create mode 100644 ScoutSuite/providers/osc/resources/fcu/__init__.py diff --git a/ScoutSuite/providers/osc/facade/__init__.py b/ScoutSuite/providers/osc/facade/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/ScoutSuite/providers/osc/resources/__init__.py b/ScoutSuite/providers/osc/resources/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/ScoutSuite/providers/osc/resources/api/__init__.py b/ScoutSuite/providers/osc/resources/api/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/ScoutSuite/providers/osc/resources/fcu/__init__.py b/ScoutSuite/providers/osc/resources/fcu/__init__.py new file mode 100644 index 000000000..e69de29bb From ae5a2066fa4388016beb20d219520ee5482fbabc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Wed, 5 Aug 2020 17:25:15 +0200 Subject: [PATCH 10/21] WIP basic OWS FCU structure --- .../providers/osc/resources/fcu/base.py | 32 +++++++++++++++++++ .../osc/resources/fcu/securitygroups.py | 24 ++++++++++++++ ScoutSuite/providers/osc/resources/regions.py | 9 ++++++ ScoutSuite/providers/osc/services.py | 3 +- 4 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 ScoutSuite/providers/osc/resources/fcu/base.py create mode 100644 ScoutSuite/providers/osc/resources/fcu/securitygroups.py diff --git a/ScoutSuite/providers/osc/resources/fcu/base.py b/ScoutSuite/providers/osc/resources/fcu/base.py new file mode 100644 index 000000000..93aaffe02 --- /dev/null +++ b/ScoutSuite/providers/osc/resources/fcu/base.py @@ -0,0 +1,32 @@ +# from ScoutSuite.providers.osc.resources.fcu.ami import OutscaleMachineImages +# from ScoutSuite.providers.osc.resources.fcu.snapshots import Snapshots +# from ScoutSuite.providers.osc.resources.fcu.volumes import Volumes +# from ScoutSuite.providers.osc.resources.fcu.vpcs import FcuVpcs +from ScoutSuite.providers.osc.resources.regions import Regions + +class FCU(Regions): + _children = [ + # (FcuVpcs, 'vpcs'), + # (OutscaleMachineImages, 'omis'), + # (Snapshots, 'snapshots'), + # (Volumes, 'volumes') + ] + + def __init__(self, facade): + super(FCU, self).__init__('fcu', facade) + + async def fetch_all(self, regions=None, excluded_regions=None, partition_name='osc', **kwargs): + # await super(FCU, self).fetch_all(regions, excluded_regions, partition_name) + await super(FCU, self).fetch_all(regions, excluded_regions) + + for region in self['regions']: + # self['regions'][region]['instances_count'] =\ + # sum([len(vpc['instances']) for vpc in self['regions'][region]['vpcs'].values()]) + self['regions'][region]['security_groups_count'] =\ + sum([len(vpc['security_groups']) for vpc in self['regions'][region]['vpcs'].values()]) + # self['regions'][region]['network_interfaces_count'] =\ + # sum([len(vpc['network_interfaces']) for vpc in self['regions'][region]['vpcs'].values()]) + + # self['instances_count'] = sum([region['instances_count'] for region in self['regions'].values()]) + self['security_groups_count'] = sum([region['security_groups_count'] for region in self['regions'].values()]) + # self['network_interfaces_count'] = sum([region['network_interfaces_count'] for region in self['regions'].values()]) diff --git a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py new file mode 100644 index 000000000..ad685ae36 --- /dev/null +++ b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py @@ -0,0 +1,24 @@ +from ScoutSuite.providers.osc.resources.base import OSCResources +from ScoutSuite.providers.osc.facade.base import OSCFacade +from ScoutSuite.utils import manage_dictionary +from ScoutSuite.core.fs import load_data + + +class SecurityGroups(OSCResources): + def __init__(self, facade: OSCFacade, region: str, vpc: str): + super(SecurityGroups, self).__init__(facade) + self.region = region + self.vpc = vpc + + async def fetch_all(self): + raw_security_groups = await self.facade.fcu.get_security_groups(self.region, self.vpc) + for raw_security_group in raw_security_groups: + name, resource = self._parse_security_group(raw_security_group) + self[name] = resource + + def _parse_security_group(self, raw_security_group): + security_group = {} + security_group['name'] = "" # raw_security_group[""] + security_group['id'] = 0 # raw_security_group[""] + + return security_group['id'], security_group \ No newline at end of file diff --git a/ScoutSuite/providers/osc/resources/regions.py b/ScoutSuite/providers/osc/resources/regions.py index 2d8eebb82..a22a374e4 100644 --- a/ScoutSuite/providers/osc/resources/regions.py +++ b/ScoutSuite/providers/osc/resources/regions.py @@ -24,3 +24,12 @@ async def fetch_all(self, regions=None, excluded_regions=None, **kwargs): scopes={region: {'region': region} for region in self['regions']} ) self._set_counts() + + def _set_counts(self): + self['regions_count'] = len(self['regions']) + + for _, key in self._children: + if key == 'vpcs': + continue + + self[key + '_count'] = sum([region[key + '_count'] for region in self['regions'].values()]) \ No newline at end of file diff --git a/ScoutSuite/providers/osc/services.py b/ScoutSuite/providers/osc/services.py index 7384a553e..86b3e9b5c 100644 --- a/ScoutSuite/providers/osc/services.py +++ b/ScoutSuite/providers/osc/services.py @@ -1,7 +1,7 @@ from ScoutSuite.providers.base.services import BaseServicesConfig from ScoutSuite.providers.osc.resources.api.base import Api from ScoutSuite.providers.osc.facade.base import OSCFacade - +from ScoutSuite.providers.osc.resources.fcu.base import FCU class OSCServicesConfig(BaseServicesConfig): """ @@ -17,6 +17,7 @@ def __init__(self, credentials=None, **kwargs): facade = OSCFacade(credentials) self.api = Api(facade) + self.fcu = FCU(facade) def _is_provider(self, provider_name): return provider_name == 'osc' From 306aa5ec3b15dbd221da00cd61e5af59e3ac0489 Mon Sep 17 00:00:00 2001 From: Tio Gobin Date: Wed, 5 Aug 2020 18:30:34 +0200 Subject: [PATCH 11/21] get_all_security_groups Facade --- ScoutSuite/providers/osc/facade/fcu.py | 27 +++++++++++++++++++ ScoutSuite/providers/osc/facade/utils.py | 7 ++--- .../osc/resources/fcu/securitygroups.py | 2 +- 3 files changed, 30 insertions(+), 6 deletions(-) create mode 100644 ScoutSuite/providers/osc/facade/fcu.py diff --git a/ScoutSuite/providers/osc/facade/fcu.py b/ScoutSuite/providers/osc/facade/fcu.py new file mode 100644 index 000000000..dcd1a1286 --- /dev/null +++ b/ScoutSuite/providers/osc/facade/fcu.py @@ -0,0 +1,27 @@ +import asyncio +import base64 +from osc_sdk_python import Gateway +import zlib + +from ScoutSuite.core.console import print_exception +from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade +from ScoutSuite.providers.osc.facade.utils import OSCFacadeUtils +from ScoutSuite.providers.utils import get_and_set_concurrently +from ScoutSuite.providers.utils import run_concurrently + + +class FcuFacade(OSCBaseFacade): + regional_flow_logs_cache_locks = {} + flow_logs_cache = {} + + def __init__(self, session: Gateway, owner_id: str): + self.owner_id = owner_id + + super(FcuFacade, self).__init__(session) + + async def get_security_groups(self): + try: + return await OSCFacadeUtils.get_all_security_groups(self.session) + except Exception as e: + print_exception('Failed to describe Fcu security groups: {}'.format(e)) + return [] diff --git a/ScoutSuite/providers/osc/facade/utils.py b/ScoutSuite/providers/osc/facade/utils.py index f4bcfd3e2..d12d523a3 100644 --- a/ScoutSuite/providers/osc/facade/utils.py +++ b/ScoutSuite/providers/osc/facade/utils.py @@ -1,11 +1,8 @@ -import json -import requests - class OSCFacadeUtils: @staticmethod - def get_all_pages(self, session): - return session.ReadVms() + def get_all_security_groups(session): + return session.ReadSecurityGroups() @staticmethod def _get_outscale_endpoint(region, version, action): return "https://api.{}.outscale.com/api/{}/{}".format( diff --git a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py index ad685ae36..4a5571ee3 100644 --- a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py +++ b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py @@ -11,7 +11,7 @@ def __init__(self, facade: OSCFacade, region: str, vpc: str): self.vpc = vpc async def fetch_all(self): - raw_security_groups = await self.facade.fcu.get_security_groups(self.region, self.vpc) + raw_security_groups = await self.facade.fcu.get_security_groups() for raw_security_group in raw_security_groups: name, resource = self._parse_security_group(raw_security_group) self[name] = resource From 073fe7af4b8ff1a3f8bb95de5a3b06786cb80071 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Wed, 5 Aug 2020 19:19:36 +0200 Subject: [PATCH 12/21] WIP --- ScoutSuite/providers/osc/facade/basefacade.py | 1 - ScoutSuite/providers/osc/facade/fcu.py | 25 +++++++++++++++++++ ScoutSuite/providers/osc/facade/utils.py | 4 ++- .../providers/osc/resources/fcu/base.py | 17 ++++++++++--- .../osc/resources/fcu/securitygroups.py | 2 ++ ScoutSuite/providers/osc/resources/regions.py | 10 +++++--- 6 files changed, 50 insertions(+), 9 deletions(-) create mode 100644 ScoutSuite/providers/osc/facade/fcu.py diff --git a/ScoutSuite/providers/osc/facade/basefacade.py b/ScoutSuite/providers/osc/facade/basefacade.py index 6c67e9f00..df22891ae 100644 --- a/ScoutSuite/providers/osc/facade/basefacade.py +++ b/ScoutSuite/providers/osc/facade/basefacade.py @@ -3,5 +3,4 @@ class OSCBaseFacade(object): def __init__(self, session: Gateway = None): - logging.getLogger('scout').critical(f"Gateway :: {Gateway}") self.session = session diff --git a/ScoutSuite/providers/osc/facade/fcu.py b/ScoutSuite/providers/osc/facade/fcu.py new file mode 100644 index 000000000..bb02e2158 --- /dev/null +++ b/ScoutSuite/providers/osc/facade/fcu.py @@ -0,0 +1,25 @@ +import asyncio + +from osc_sdk_python import Gateway + +from ScoutSuite.core.console import print_exception +from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade +from ScoutSuite.providers.osc.facade.utils import OSCFacadeUtils + + +class FCUFacade(OSCBaseFacade): + def __init__(self, session: Gateway, owner_id: str): + self.owner_id = owner_id + + super(FCUFacade, self).__init__(session) + + async def get_security_groups(self, region: str, vpc: str): + import logging + logging.getLogger('scout').critical("Test get_security_groups") + try: + return await OSCFacadeUtils.get_all_pages( + 'fcu', region, self.session, 'describe_security_groups', 'SecurityGroups', Filters=filters + ) + except Exception as e: + print_exception('Failed to describe FCU security groups: {}'.format(e)) + return [] diff --git a/ScoutSuite/providers/osc/facade/utils.py b/ScoutSuite/providers/osc/facade/utils.py index f4bcfd3e2..79cbe1b17 100644 --- a/ScoutSuite/providers/osc/facade/utils.py +++ b/ScoutSuite/providers/osc/facade/utils.py @@ -4,7 +4,9 @@ class OSCFacadeUtils: @staticmethod - def get_all_pages(self, session): + async def get_all_pages(self, session): + import logging + logging.getLogger('scout').critical("Test OSCFacadeUtils::get_all_pages()") return session.ReadVms() @staticmethod def _get_outscale_endpoint(region, version, action): diff --git a/ScoutSuite/providers/osc/resources/fcu/base.py b/ScoutSuite/providers/osc/resources/fcu/base.py index 93aaffe02..5b05d2754 100644 --- a/ScoutSuite/providers/osc/resources/fcu/base.py +++ b/ScoutSuite/providers/osc/resources/fcu/base.py @@ -2,10 +2,12 @@ # from ScoutSuite.providers.osc.resources.fcu.snapshots import Snapshots # from ScoutSuite.providers.osc.resources.fcu.volumes import Volumes # from ScoutSuite.providers.osc.resources.fcu.vpcs import FcuVpcs +from ScoutSuite.providers.osc.resources.fcu.securitygroups import SecurityGroups from ScoutSuite.providers.osc.resources.regions import Regions class FCU(Regions): _children = [ + (SecurityGroups, 'security_groups') # (FcuVpcs, 'vpcs'), # (OutscaleMachineImages, 'omis'), # (Snapshots, 'snapshots'), @@ -14,19 +16,28 @@ class FCU(Regions): def __init__(self, facade): super(FCU, self).__init__('fcu', facade) + import logging + logging.getLogger("scout").critical("OSC Ressource FCU\n\n\n\n\n") async def fetch_all(self, regions=None, excluded_regions=None, partition_name='osc', **kwargs): # await super(FCU, self).fetch_all(regions, excluded_regions, partition_name) + import logging + logging.getLogger("scout").critical("OSC FCU.fetch_all()\n\n\n") await super(FCU, self).fetch_all(regions, excluded_regions) + logging.getLogger("scout").critical("Regions :::") + logging.getLogger("scout").critical(self['regions']) for region in self['regions']: + logging.getLogger("scout").critical(self['regions'][region]['security_groups'].values()) + # self['regions'][region]['security_groups_count'] =\ + # sum([len(sg) for sg in self['regions'][region]['security_groups'].values()]) # self['regions'][region]['instances_count'] =\ # sum([len(vpc['instances']) for vpc in self['regions'][region]['vpcs'].values()]) - self['regions'][region]['security_groups_count'] =\ - sum([len(vpc['security_groups']) for vpc in self['regions'][region]['vpcs'].values()]) + # self['regions'][region]['security_groups_count'] =\ + # sum([len(vpc['security_groups']) for vpc in self['regions'][region]['vpcs'].values()]) # self['regions'][region]['network_interfaces_count'] =\ # sum([len(vpc['network_interfaces']) for vpc in self['regions'][region]['vpcs'].values()]) # self['instances_count'] = sum([region['instances_count'] for region in self['regions'].values()]) - self['security_groups_count'] = sum([region['security_groups_count'] for region in self['regions'].values()]) + # self['security_groups_count'] = sum([region['security_groups_count'] for region in self['regions'].values()]) # self['network_interfaces_count'] = sum([region['network_interfaces_count'] for region in self['regions'].values()]) diff --git a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py index ad685ae36..9130da330 100644 --- a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py +++ b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py @@ -3,9 +3,11 @@ from ScoutSuite.utils import manage_dictionary from ScoutSuite.core.fs import load_data +import logging class SecurityGroups(OSCResources): def __init__(self, facade: OSCFacade, region: str, vpc: str): + logging.getLogger("scout").critical("OSC Security Groups\n\n\n\n\n") super(SecurityGroups, self).__init__(facade) self.region = region self.vpc = vpc diff --git a/ScoutSuite/providers/osc/resources/regions.py b/ScoutSuite/providers/osc/resources/regions.py index a22a374e4..51ad134df 100644 --- a/ScoutSuite/providers/osc/resources/regions.py +++ b/ScoutSuite/providers/osc/resources/regions.py @@ -11,14 +11,16 @@ def __init__(self, service: str, facade: OSCFacade): self.service = service async def fetch_all(self, regions=None, excluded_regions=None, **kwargs): - self["region"] = {} - for region in await self.facade.build_region_list(self.service, - regions, excluded_regions): - self["region"][region] = { + import logging + logging.getLogger("scout").critical("OSC ::: Regions::fetch_all()") + self['regions'] = {} + for region in await self.facade.build_region_list(self.service, regions, excluded_regions): + self['regions'][region['RegionName']] = { 'id': region, 'region': region, 'name': region } + await self._fetch_children_of_all_resources( resources=self['regions'], scopes={region: {'region': region} for region in self['regions']} From 6a119697bd42118e5d9b130e6ad71a5288badd95 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Wed, 5 Aug 2020 19:22:05 +0200 Subject: [PATCH 13/21] Temporarily disable snapshots fetch_all() --- ScoutSuite/providers/osc/resources/api/snapshots.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ScoutSuite/providers/osc/resources/api/snapshots.py b/ScoutSuite/providers/osc/resources/api/snapshots.py index b417613da..0e9090a13 100644 --- a/ScoutSuite/providers/osc/resources/api/snapshots.py +++ b/ScoutSuite/providers/osc/resources/api/snapshots.py @@ -9,7 +9,8 @@ def __init__(self, facade: OSCFacade, region: str): self.region = region async def fetch_all(self): - raw_snapshots = await self.facade.api.list_snapshots() + # raw_snapshots = await self.facade.api.list_snapshots() + raw_snapshots = [] for raw_snapshot in raw_snapshots: name, resource = self._parse_snapshot(raw_snapshot) self[name] = resource \ No newline at end of file From daa49f0acd92fc3f40b16f267cf9efc856c69b4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Wed, 5 Aug 2020 21:12:22 +0200 Subject: [PATCH 14/21] WIP, not working, Error code 1 User unidentified --- ScoutSuite/providers/osc/facade/base.py | 21 +++++++++++-- ScoutSuite/providers/osc/facade/fcu.py | 11 +++---- ScoutSuite/providers/osc/facade/utils.py | 8 +++-- .../providers/osc/resources/api/base.py | 5 ++-- .../providers/osc/resources/fcu/base.py | 9 ++++-- .../osc/resources/fcu/securitygroups.py | 11 +++++-- ScoutSuite/providers/osc/resources/regions.py | 30 +++++++++++-------- 7 files changed, 65 insertions(+), 30 deletions(-) diff --git a/ScoutSuite/providers/osc/facade/base.py b/ScoutSuite/providers/osc/facade/base.py index dee747113..0a86dcdd5 100644 --- a/ScoutSuite/providers/osc/facade/base.py +++ b/ScoutSuite/providers/osc/facade/base.py @@ -1,11 +1,17 @@ from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade from ScoutSuite.providers.osc.facade.api import ApiFacade +from ScoutSuite.providers.osc.facade.fcu import FCUFacade import requests class OSCFacade(OSCBaseFacade): def __init__(self, credentials=None): super(OSCFacade, self).__init__() - self.session = credentials.session + import logging + logging.getLogger('scout').critical("OSC ::: OSCFacade::__init__()") + logging.getLogger('scout').critical(f"credentials {credentials}") + logging.getLogger('scout').critical(f"session {credentials.session}") + # self.session = credentials.session + self.session = credentials self._instantiate_facades() async def build_region_list(self, service: str, chosen_regions=None, @@ -15,7 +21,18 @@ async def build_region_list(self, service: str, chosen_regions=None, regions_list = [] for region in regions: regions_list.append(region["RegionName"]) + + not_opted_in_regions = [] + # TODO + + if chosen_regions: + regions = [r for r in regions if r in chosen_regions] + if excluded_regions: + regions = [r for r in regions if r not in excluded_regions] + if not_opted_in_regions: + regions = [r for r in regions if r not in not_opted_in_regions] return regions def _instantiate_facades(self): - self.api = ApiFacade(self.session) \ No newline at end of file + self.api = ApiFacade(self.session) + self.fcu = FCUFacade(self.session) \ No newline at end of file diff --git a/ScoutSuite/providers/osc/facade/fcu.py b/ScoutSuite/providers/osc/facade/fcu.py index 1543d3ebf..a8dfb15fd 100644 --- a/ScoutSuite/providers/osc/facade/fcu.py +++ b/ScoutSuite/providers/osc/facade/fcu.py @@ -11,14 +11,15 @@ class FCUFacade(OSCBaseFacade): - def __init__(self, session: Gateway, owner_id: str): - self.owner_id = owner_id - + def __init__(self, session: Gateway): + # def __init__(self, session: Gateway, owner_id: str): + # self.owner_id = owner_id + self.session = session super(FCUFacade, self).__init__(session) - async def get_security_groups(self, region: str, vpc: str): + async def get_security_groups(self, region: str, vpc: str = None): import logging - logging.getLogger('scout').critical("Test get_security_groups") + logging.getLogger('scout').critical("OSC ::: FCUFacade::get_security_groups()") try: # return await OSCFacadeUtils.get_all_pages( # 'fcu', region, self.session, 'describe_security_groups', 'SecurityGroups', Filters=filters diff --git a/ScoutSuite/providers/osc/facade/utils.py b/ScoutSuite/providers/osc/facade/utils.py index b372e0fcc..dc4dc45d8 100644 --- a/ScoutSuite/providers/osc/facade/utils.py +++ b/ScoutSuite/providers/osc/facade/utils.py @@ -1,10 +1,14 @@ +from osc_sdk_python import Gateway + class OSCFacadeUtils: @staticmethod - async def get_all_security_groups(self, session): + async def get_all_security_groups(session: Gateway): import logging - logging.getLogger('scout').critical("Test OSCFacadeUtils::get_all_pages()") + logging.getLogger('scout').critical("OSC ::: OSCFacadeUtils::get_security_groups()") + logging.getLogger('scout').critical(f"session ::: {session}") return session.ReadSecurityGroups() + @staticmethod def _get_outscale_endpoint(region, version, action): return "https://api.{}.outscale.com/api/{}/{}".format( diff --git a/ScoutSuite/providers/osc/resources/api/base.py b/ScoutSuite/providers/osc/resources/api/base.py index aee132063..ddd8e47e5 100644 --- a/ScoutSuite/providers/osc/resources/api/base.py +++ b/ScoutSuite/providers/osc/resources/api/base.py @@ -2,6 +2,7 @@ #from ScoutSuite.providers.osc.resources.api.volumes import Volumes #from ScoutSuite.providers.osc.resources.api.vpcs import Vpcs #from ScoutSuite.providers.osc.resources.api.instances import Instances +from ScoutSuite.providers.osc.resources.fcu.securitygroups import SecurityGroups from ScoutSuite.providers.osc.resources.regions import Regions @@ -9,8 +10,8 @@ class Api(Regions): _children = [ #(Vpcs, 'vpcs'), #(Instances, 'instances'), - (Snapshots, 'snapshots'), - # (Volumes, 'volumes') + #(Snapshots, 'snapshots'), + #(Volumes, 'volumes') ] def __init__(self, facade): diff --git a/ScoutSuite/providers/osc/resources/fcu/base.py b/ScoutSuite/providers/osc/resources/fcu/base.py index 5b05d2754..f371becd8 100644 --- a/ScoutSuite/providers/osc/resources/fcu/base.py +++ b/ScoutSuite/providers/osc/resources/fcu/base.py @@ -17,18 +17,21 @@ class FCU(Regions): def __init__(self, facade): super(FCU, self).__init__('fcu', facade) import logging - logging.getLogger("scout").critical("OSC Ressource FCU\n\n\n\n\n") + logging.getLogger("scout").critical("OSC ::: Ressource FCU\n\n\n\n\n") async def fetch_all(self, regions=None, excluded_regions=None, partition_name='osc', **kwargs): # await super(FCU, self).fetch_all(regions, excluded_regions, partition_name) import logging - logging.getLogger("scout").critical("OSC FCU.fetch_all()\n\n\n") + logging.getLogger("scout").critical("OSC ::: FCU.fetch_all()\n\n\n") await super(FCU, self).fetch_all(regions, excluded_regions) + logging.getLogger("scout").critical("OSC ::: ! FCU.fetch_all()\n\n\n") logging.getLogger("scout").critical("Regions :::") logging.getLogger("scout").critical(self['regions']) for region in self['regions']: - logging.getLogger("scout").critical(self['regions'][region]['security_groups'].values()) + logging.getLogger("scout").critical(f"OSC ::: region :: {region}") + logging.getLogger("scout").critical(f"OSC ::: {self['regions'][region]}") + # logging.getLogger("scout").critical(self['regions'][region]['security_groups'].values()) # self['regions'][region]['security_groups_count'] =\ # sum([len(sg) for sg in self['regions'][region]['security_groups'].values()]) # self['regions'][region]['instances_count'] =\ diff --git a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py index 328476fa4..d20359986 100644 --- a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py +++ b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py @@ -6,14 +6,19 @@ import logging class SecurityGroups(OSCResources): - def __init__(self, facade: OSCFacade, region: str, vpc: str): - logging.getLogger("scout").critical("OSC Security Groups\n\n\n\n\n") + def __init__(self, facade: OSCFacade, region: str, vpc: str = None): + logging.getLogger("scout").critical("OSC ::: Security Groups\n\n\n\n\n") super(SecurityGroups, self).__init__(facade) self.region = region self.vpc = vpc async def fetch_all(self): - raw_security_groups = await self.facade.fcu.get_security_groups() + logging.getLogger("scout").critical("OSC ::: SecurityGroups.fetch_all()") + try: + raw_security_groups = await self.facade.fcu.get_security_groups(self.region) + except Exception as e: + logging.getLogger("scout").critical(f"OSC ::: Exception {e}") + logging.getLogger("scout").critical(f"OSC ::: security groups {raw_security_groups}") for raw_security_group in raw_security_groups: name, resource = self._parse_security_group(raw_security_group) self[name] = resource diff --git a/ScoutSuite/providers/osc/resources/regions.py b/ScoutSuite/providers/osc/resources/regions.py index 51ad134df..d8c6252f4 100644 --- a/ScoutSuite/providers/osc/resources/regions.py +++ b/ScoutSuite/providers/osc/resources/regions.py @@ -13,19 +13,23 @@ def __init__(self, service: str, facade: OSCFacade): async def fetch_all(self, regions=None, excluded_regions=None, **kwargs): import logging logging.getLogger("scout").critical("OSC ::: Regions::fetch_all()") - self['regions'] = {} - for region in await self.facade.build_region_list(self.service, regions, excluded_regions): - self['regions'][region['RegionName']] = { - 'id': region, - 'region': region, - 'name': region - } - - await self._fetch_children_of_all_resources( - resources=self['regions'], - scopes={region: {'region': region} for region in self['regions']} - ) - self._set_counts() + try: + self['regions'] = {} + for region in await self.facade.build_region_list(self.service, regions, excluded_regions): + self['regions'][region['RegionName']] = { + 'id': region['RegionName'], + 'region': region, + 'name': region['RegionName'], + 'endpoint': region['Endpoint'] + } + + await self._fetch_children_of_all_resources( + resources=self['regions'], + scopes={region: {'region': region} for region in self['regions']} + ) + self._set_counts() + except Exception as e: + logging.getLogger("scout").critical(f"OSC ::: Exception ::: {e}") def _set_counts(self): self['regions_count'] = len(self['regions']) From 6c9bc08c30f1e22660635e4e4cfbc220fc00f738 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Thu, 6 Aug 2020 11:58:14 +0200 Subject: [PATCH 15/21] WIP Disable Api, logs --- ScoutSuite/providers/osc/facade/api.py | 18 --------------- ScoutSuite/providers/osc/facade/base.py | 4 ++-- .../providers/osc/resources/api/__init__.py | 0 .../providers/osc/resources/api/base.py | 22 ------------------- .../providers/osc/resources/api/instances.py | 0 .../providers/osc/resources/api/snapshots.py | 16 -------------- .../providers/osc/resources/api/volumes.py | 0 .../providers/osc/resources/api/vpcs.py | 0 .../osc/resources/fcu/securitygroups.py | 12 +++++----- ScoutSuite/providers/osc/services.py | 4 ++-- 10 files changed, 10 insertions(+), 66 deletions(-) delete mode 100644 ScoutSuite/providers/osc/facade/api.py delete mode 100644 ScoutSuite/providers/osc/resources/api/__init__.py delete mode 100644 ScoutSuite/providers/osc/resources/api/base.py delete mode 100644 ScoutSuite/providers/osc/resources/api/instances.py delete mode 100644 ScoutSuite/providers/osc/resources/api/snapshots.py delete mode 100644 ScoutSuite/providers/osc/resources/api/volumes.py delete mode 100644 ScoutSuite/providers/osc/resources/api/vpcs.py diff --git a/ScoutSuite/providers/osc/facade/api.py b/ScoutSuite/providers/osc/facade/api.py deleted file mode 100644 index e839f2231..000000000 --- a/ScoutSuite/providers/osc/facade/api.py +++ /dev/null @@ -1,18 +0,0 @@ -from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade -from osc_sdk_python import Gateway -from ScoutSuite.providers.osc.facade.utils import OSCFacadeUtils -from ScoutSuite.core.console import print_exception - - -class ApiFacade(OSCBaseFacade): - - def __init__(self, session: Gateway): - super(ApiFacade, self).__init__(session) - - async def get_instances(self, region: str): - try: - instances = OSCFacadeUtils.get_all_instances(self.session) - except Exception as e: - print_exception('Failed to describe instances: {}'.format(e)) - return [] - diff --git a/ScoutSuite/providers/osc/facade/base.py b/ScoutSuite/providers/osc/facade/base.py index 0a86dcdd5..36bcefcc0 100644 --- a/ScoutSuite/providers/osc/facade/base.py +++ b/ScoutSuite/providers/osc/facade/base.py @@ -1,5 +1,5 @@ from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade -from ScoutSuite.providers.osc.facade.api import ApiFacade +# from ScoutSuite.providers.osc.facade.api import ApiFacade from ScoutSuite.providers.osc.facade.fcu import FCUFacade import requests @@ -34,5 +34,5 @@ async def build_region_list(self, service: str, chosen_regions=None, return regions def _instantiate_facades(self): - self.api = ApiFacade(self.session) + # self.api = ApiFacade(self.session) self.fcu = FCUFacade(self.session) \ No newline at end of file diff --git a/ScoutSuite/providers/osc/resources/api/__init__.py b/ScoutSuite/providers/osc/resources/api/__init__.py deleted file mode 100644 index e69de29bb..000000000 diff --git a/ScoutSuite/providers/osc/resources/api/base.py b/ScoutSuite/providers/osc/resources/api/base.py deleted file mode 100644 index ddd8e47e5..000000000 --- a/ScoutSuite/providers/osc/resources/api/base.py +++ /dev/null @@ -1,22 +0,0 @@ -from ScoutSuite.providers.osc.resources.api.snapshots import Snapshots -#from ScoutSuite.providers.osc.resources.api.volumes import Volumes -#from ScoutSuite.providers.osc.resources.api.vpcs import Vpcs -#from ScoutSuite.providers.osc.resources.api.instances import Instances -from ScoutSuite.providers.osc.resources.fcu.securitygroups import SecurityGroups -from ScoutSuite.providers.osc.resources.regions import Regions - - -class Api(Regions): - _children = [ - #(Vpcs, 'vpcs'), - #(Instances, 'instances'), - #(Snapshots, 'snapshots'), - #(Volumes, 'volumes') - ] - - def __init__(self, facade): - super(Api, self).__init__('api', facade) - - async def fetch_all(self, regions=None, excluded_regions=None, partition_name='aws', **kwargs): - await super(Api, self).fetch_all(regions, excluded_regions, partition_name=partition_name) - diff --git a/ScoutSuite/providers/osc/resources/api/instances.py b/ScoutSuite/providers/osc/resources/api/instances.py deleted file mode 100644 index e69de29bb..000000000 diff --git a/ScoutSuite/providers/osc/resources/api/snapshots.py b/ScoutSuite/providers/osc/resources/api/snapshots.py deleted file mode 100644 index 0e9090a13..000000000 --- a/ScoutSuite/providers/osc/resources/api/snapshots.py +++ /dev/null @@ -1,16 +0,0 @@ -from ScoutSuite.providers.osc.resources.base import OSCResources -from ScoutSuite.providers.osc.facade.base import OSCFacade - - -class Snapshots(OSCResources): - - def __init__(self, facade: OSCFacade, region: str): - super(Snapshots, self).__init__(facade) - self.region = region - - async def fetch_all(self): - # raw_snapshots = await self.facade.api.list_snapshots() - raw_snapshots = [] - for raw_snapshot in raw_snapshots: - name, resource = self._parse_snapshot(raw_snapshot) - self[name] = resource \ No newline at end of file diff --git a/ScoutSuite/providers/osc/resources/api/volumes.py b/ScoutSuite/providers/osc/resources/api/volumes.py deleted file mode 100644 index e69de29bb..000000000 diff --git a/ScoutSuite/providers/osc/resources/api/vpcs.py b/ScoutSuite/providers/osc/resources/api/vpcs.py deleted file mode 100644 index e69de29bb..000000000 diff --git a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py index d20359986..4a063adf1 100644 --- a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py +++ b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py @@ -13,15 +13,15 @@ def __init__(self, facade: OSCFacade, region: str, vpc: str = None): self.vpc = vpc async def fetch_all(self): - logging.getLogger("scout").critical("OSC ::: SecurityGroups.fetch_all()") try: + logging.getLogger("scout").critical("OSC ::: SecurityGroups.fetch_all()") raw_security_groups = await self.facade.fcu.get_security_groups(self.region) + logging.getLogger("scout").critical(f"OSC ::: security groups {raw_security_groups}") + for raw_security_group in raw_security_groups: + name, resource = self._parse_security_group(raw_security_group) + self[name] = resource except Exception as e: - logging.getLogger("scout").critical(f"OSC ::: Exception {e}") - logging.getLogger("scout").critical(f"OSC ::: security groups {raw_security_groups}") - for raw_security_group in raw_security_groups: - name, resource = self._parse_security_group(raw_security_group) - self[name] = resource + logging.getLogger("scout").critical(f"OSC ::: Exception {e}\n\n\n") def _parse_security_group(self, raw_security_group): security_group = {} diff --git a/ScoutSuite/providers/osc/services.py b/ScoutSuite/providers/osc/services.py index 86b3e9b5c..43430fd8b 100644 --- a/ScoutSuite/providers/osc/services.py +++ b/ScoutSuite/providers/osc/services.py @@ -1,5 +1,5 @@ from ScoutSuite.providers.base.services import BaseServicesConfig -from ScoutSuite.providers.osc.resources.api.base import Api +# from ScoutSuite.providers.osc.resources.api.base import Api from ScoutSuite.providers.osc.facade.base import OSCFacade from ScoutSuite.providers.osc.resources.fcu.base import FCU @@ -16,7 +16,7 @@ def __init__(self, credentials=None, **kwargs): facade = OSCFacade(credentials) - self.api = Api(facade) + # self.api = Api(facade) self.fcu = FCU(facade) def _is_provider(self, provider_name): From 1eafba170b9b05419838db54b50392ca2c3d5288 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Thu, 6 Aug 2020 12:53:44 +0200 Subject: [PATCH 16/21] WIP Fix security groups acquisition --- ScoutSuite/providers/osc/facade/fcu.py | 3 +- ScoutSuite/providers/osc/facade/utils.py | 11 +- .../providers/osc/resources/fcu/base.py | 6 +- .../osc/resources/fcu/securitygroups.py | 156 +++++++++++++++++- ScoutSuite/providers/osc/resources/regions.py | 4 +- .../security-group-opens-all-ports.json | 2 +- 6 files changed, 167 insertions(+), 15 deletions(-) diff --git a/ScoutSuite/providers/osc/facade/fcu.py b/ScoutSuite/providers/osc/facade/fcu.py index a8dfb15fd..6a37b8231 100644 --- a/ScoutSuite/providers/osc/facade/fcu.py +++ b/ScoutSuite/providers/osc/facade/fcu.py @@ -24,7 +24,8 @@ async def get_security_groups(self, region: str, vpc: str = None): # return await OSCFacadeUtils.get_all_pages( # 'fcu', region, self.session, 'describe_security_groups', 'SecurityGroups', Filters=filters # ) - return await OSCFacadeUtils.get_all_security_groups(self.session) + security_groups = await OSCFacadeUtils.get_all_security_groups(self.session) + return security_groups except Exception as e: print_exception('Failed to describe FCU security groups: {}'.format(e)) return [] diff --git a/ScoutSuite/providers/osc/facade/utils.py b/ScoutSuite/providers/osc/facade/utils.py index dc4dc45d8..7498d0c13 100644 --- a/ScoutSuite/providers/osc/facade/utils.py +++ b/ScoutSuite/providers/osc/facade/utils.py @@ -4,10 +4,13 @@ class OSCFacadeUtils: @staticmethod async def get_all_security_groups(session: Gateway): - import logging - logging.getLogger('scout').critical("OSC ::: OSCFacadeUtils::get_security_groups()") - logging.getLogger('scout').critical(f"session ::: {session}") - return session.ReadSecurityGroups() + response = session.ReadSecurityGroups() + security_groups = [] + if 'SecurityGroups' in response: + for security_group in response['SecurityGroups']: + security_groups.append(security_group) + return security_groups + @staticmethod def _get_outscale_endpoint(region, version, action): diff --git a/ScoutSuite/providers/osc/resources/fcu/base.py b/ScoutSuite/providers/osc/resources/fcu/base.py index f371becd8..41bf82e3f 100644 --- a/ScoutSuite/providers/osc/resources/fcu/base.py +++ b/ScoutSuite/providers/osc/resources/fcu/base.py @@ -32,8 +32,8 @@ async def fetch_all(self, regions=None, excluded_regions=None, partition_name='o logging.getLogger("scout").critical(f"OSC ::: region :: {region}") logging.getLogger("scout").critical(f"OSC ::: {self['regions'][region]}") # logging.getLogger("scout").critical(self['regions'][region]['security_groups'].values()) - # self['regions'][region]['security_groups_count'] =\ - # sum([len(sg) for sg in self['regions'][region]['security_groups'].values()]) + self['regions'][region]['security_groups_count'] =\ + sum([len(sg) for sg in self['regions'][region]['security_groups'].values()]) # self['regions'][region]['instances_count'] =\ # sum([len(vpc['instances']) for vpc in self['regions'][region]['vpcs'].values()]) # self['regions'][region]['security_groups_count'] =\ @@ -42,5 +42,5 @@ async def fetch_all(self, regions=None, excluded_regions=None, partition_name='o # sum([len(vpc['network_interfaces']) for vpc in self['regions'][region]['vpcs'].values()]) # self['instances_count'] = sum([region['instances_count'] for region in self['regions'].values()]) - # self['security_groups_count'] = sum([region['security_groups_count'] for region in self['regions'].values()]) + self['security_groups_count'] = sum([region['security_groups_count'] for region in self['regions'].values()]) # self['network_interfaces_count'] = sum([region['network_interfaces_count'] for region in self['regions'].values()]) diff --git a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py index 4a063adf1..5a37658d9 100644 --- a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py +++ b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py @@ -21,11 +21,159 @@ async def fetch_all(self): name, resource = self._parse_security_group(raw_security_group) self[name] = resource except Exception as e: - logging.getLogger("scout").critical(f"OSC ::: Exception {e}\n\n\n") + logging.getLogger("scout").critical(f"OSC ::: SecurityGroups _fecth_all() Exception {e}\n\n\n") def _parse_security_group(self, raw_security_group): + import logging security_group = {} - security_group['name'] = "" # raw_security_group[""] - security_group['id'] = 0 # raw_security_group[""] + security_group['name'] = raw_security_group['SecurityGroupName'] + logging.getLogger("scout").critical("OSC ::: 000") + security_group['id'] = raw_security_group['SecurityGroupId'] + security_group['description'] = raw_security_group['Description'] + security_group['owner_id'] = raw_security_group['AccountId'] - return security_group['id'], security_group \ No newline at end of file + if 'Tags' in raw_security_group: + pass # TODO + security_group['rules'] = {'ingress': {}, 'egress': {}} + ingress_protocols, ingress_rules_count = self._parse_security_group_rules( + raw_security_group['InboundRules']) + security_group['rules']['ingress']['protocols'] = ingress_protocols + security_group['rules']['ingress']['count'] = ingress_rules_count + egress_protocols, egress_rules_count = self._parse_security_group_rules( + raw_security_group['OutboundRules']) + security_group['rules']['egress']['protocols'] = egress_protocols + security_group['rules']['egress']['count'] = egress_rules_count + return security_group['id'], security_group + + def _parse_security_group_rules(self, rules): + protocols = {} + rules_count = 0 + for rule in rules: + ip_protocol = rule['IpProtocol'].upper() + if ip_protocol == '-1': + ip_protocol = 'ALL' + protocols = manage_dictionary(protocols, ip_protocol, {}) + protocols[ip_protocol] = manage_dictionary( + protocols[ip_protocol], 'ports', {}) + + # Save the port (single port or range) + port_value = '1-65535' + if 'FromPort' in rule and 'ToPort' in rule: + if ip_protocol == 'ICMP': + # FromPort with ICMP is the type of message + # port_value = self.icmp_message_types_dict[str( + # rule['FromPort'])] + # TODO + pass + elif rule['FromPort'] == rule['ToPort']: + port_value = str(rule['FromPort']) + else: + port_value = '%s-%s' % (rule['FromPort'], rule['ToPort']) + manage_dictionary(protocols[ip_protocol]['ports'], port_value, {}) + + # Save grants, values are either a CIDR or an EC2 security group + # TODO If Ouscale has something equivalent + # for grant in rule['UserIdGroupPairs']: + # manage_dictionary( + # protocols[ip_protocol]['ports'][port_value], 'security_groups', []) + # protocols[ip_protocol]['ports'][port_value]['security_groups'].append( + # grant) + # rules_count = rules_count + 1 + # for grant in rule['IpRanges']: + # manage_dictionary( + # protocols[ip_protocol]['ports'][port_value], 'cidrs', []) + # protocols[ip_protocol]['ports'][port_value]['cidrs'].append( + # {'CIDR': grant['CidrIp']}) + # rules_count = rules_count + 1 + + # IPv6 + # TODO If Outscale has something equivalent + # for grant in rule['Ipv6Ranges']: + # manage_dictionary( + # protocols[ip_protocol]['ports'][port_value], 'cidrs', []) + # protocols[ip_protocol]['ports'][port_value]['cidrs'].append( + # {'CIDR': grant['CidrIpv6']}) + # rules_count = rules_count + 1 + + return protocols, rules_count + + # {'ResponseContext': + # {'RequestId': '7fcf7f96-71fb-47c8-a9e9-e9798b375158'}, + # 'SecurityGroups': + # [ + # {'AccountId': '392579172836', + # 'Description': 'default security group', + # 'InboundRules': + # [ + # { + # 'FromPortRange': -1, + # 'IpProtocol': 'icmp', + # 'IpRanges': [], + # 'SecurityGroupsMembers': + # [ + # { + # 'AccountId': '392579172836', + # 'SecurityGroupId': 'sg-bd4167b3', + # 'SecurityGroupName': 'default' + # } + # ], + # 'ServiceIds': [], + # 'ToPortRange': -1 + # }, + # { + # 'FromPortRange': 0, + # 'IpProtocol': 'tcp', + # 'IpRanges': [], + # 'SecurityGroupsMembers': + # [ + # { + # 'AccountId': '392579172836', + # 'SecurityGroupId': 'sg-bd4167b3', + # 'SecurityGroupName': 'default' + # } + # ], + # 'ServiceIds': [], + # 'ToPortRange': 65535 + # }, + # { + # 'FromPortRange': 0, + # 'IpProtocol': 'udp', + # 'IpRanges': [], + # 'SecurityGroupsMembers': + # [ + # { + # 'AccountId': '392579172836', + # 'SecurityGroupId': 'sg-bd4167b3', + # 'SecurityGroupName': 'default' + # } + # ], + # 'ServiceIds': [], + # 'ToPortRange': 65535 + # } + # ], + # 'OutboundRules': [], + # 'SecurityGroupId': 'sg-bd4167b3', + # 'SecurityGroupName': 'default', + # 'Tags': [] + # }, + # { + # 'AccountId': '392579172836', + # 'Description': 'Foirage', + # 'InboundRules': + # [ + # { + # 'FromPortRange': 0, + # 'IpProtocol': 'tcp', + # 'IpRanges': ['0.0.0.0/0'], + # 'SecurityGroupsMembers': [], + # 'ServiceIds': [], + # 'ToPortRange': 65535 + # } + # ], + # 'OutboundRules': [], + # 'SecurityGroupId': 'sg-ec5a5815', + # 'SecurityGroupName': 'Test SG Foireux', + # 'Tags': [] + # } + # ] + # } \ No newline at end of file diff --git a/ScoutSuite/providers/osc/resources/regions.py b/ScoutSuite/providers/osc/resources/regions.py index d8c6252f4..3d7f77e1b 100644 --- a/ScoutSuite/providers/osc/resources/regions.py +++ b/ScoutSuite/providers/osc/resources/regions.py @@ -22,14 +22,14 @@ async def fetch_all(self, regions=None, excluded_regions=None, **kwargs): 'name': region['RegionName'], 'endpoint': region['Endpoint'] } - await self._fetch_children_of_all_resources( resources=self['regions'], scopes={region: {'region': region} for region in self['regions']} ) self._set_counts() except Exception as e: - logging.getLogger("scout").critical(f"OSC ::: Exception ::: {e}") + logging.getLogger("scout").critical(f"OSC ::: Regions _fetch_all() Exception ::: {e}") + def _set_counts(self): self['regions_count'] = len(self['regions']) diff --git a/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json b/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json index 26162fb65..765a39d84 100644 --- a/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json +++ b/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json @@ -1,7 +1,7 @@ { "conditions": [ "and", [ "or", - [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id.protocols.id.ports.id", "equal", "0-65535" ], + [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id.protocols.id.ports.id", "equal", "1-65535" ], [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id.protocols.id", "equal", "ALL" ] ], [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id", "equal", "ingress"] From cde1ec19dbfacef530ca7251ffac14ef87ac1086 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Thu, 6 Aug 2020 12:57:27 +0200 Subject: [PATCH 17/21] WIP Clean comments --- .../osc/resources/fcu/securitygroups.py | 81 ------------------- 1 file changed, 81 deletions(-) diff --git a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py index 5a37658d9..711e87a6e 100644 --- a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py +++ b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py @@ -96,84 +96,3 @@ def _parse_security_group_rules(self, rules): # rules_count = rules_count + 1 return protocols, rules_count - - # {'ResponseContext': - # {'RequestId': '7fcf7f96-71fb-47c8-a9e9-e9798b375158'}, - # 'SecurityGroups': - # [ - # {'AccountId': '392579172836', - # 'Description': 'default security group', - # 'InboundRules': - # [ - # { - # 'FromPortRange': -1, - # 'IpProtocol': 'icmp', - # 'IpRanges': [], - # 'SecurityGroupsMembers': - # [ - # { - # 'AccountId': '392579172836', - # 'SecurityGroupId': 'sg-bd4167b3', - # 'SecurityGroupName': 'default' - # } - # ], - # 'ServiceIds': [], - # 'ToPortRange': -1 - # }, - # { - # 'FromPortRange': 0, - # 'IpProtocol': 'tcp', - # 'IpRanges': [], - # 'SecurityGroupsMembers': - # [ - # { - # 'AccountId': '392579172836', - # 'SecurityGroupId': 'sg-bd4167b3', - # 'SecurityGroupName': 'default' - # } - # ], - # 'ServiceIds': [], - # 'ToPortRange': 65535 - # }, - # { - # 'FromPortRange': 0, - # 'IpProtocol': 'udp', - # 'IpRanges': [], - # 'SecurityGroupsMembers': - # [ - # { - # 'AccountId': '392579172836', - # 'SecurityGroupId': 'sg-bd4167b3', - # 'SecurityGroupName': 'default' - # } - # ], - # 'ServiceIds': [], - # 'ToPortRange': 65535 - # } - # ], - # 'OutboundRules': [], - # 'SecurityGroupId': 'sg-bd4167b3', - # 'SecurityGroupName': 'default', - # 'Tags': [] - # }, - # { - # 'AccountId': '392579172836', - # 'Description': 'Foirage', - # 'InboundRules': - # [ - # { - # 'FromPortRange': 0, - # 'IpProtocol': 'tcp', - # 'IpRanges': ['0.0.0.0/0'], - # 'SecurityGroupsMembers': [], - # 'ServiceIds': [], - # 'ToPortRange': 65535 - # } - # ], - # 'OutboundRules': [], - # 'SecurityGroupId': 'sg-ec5a5815', - # 'SecurityGroupName': 'Test SG Foireux', - # 'Tags': [] - # } - # ] - # } \ No newline at end of file From a155f82af23fea12debe54f1b769fffc40523d0c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Michaux?= Date: Thu, 6 Aug 2020 13:04:21 +0200 Subject: [PATCH 18/21] Fix security groups rules --- .../rules/conditions/security-group-opens-all-ports.json | 6 +++--- .../rules/findings/fcu-security-group-opens-all-ports.json | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json b/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json index 765a39d84..528be7fc6 100644 --- a/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json +++ b/ScoutSuite/providers/osc/rules/conditions/security-group-opens-all-ports.json @@ -1,9 +1,9 @@ { "conditions": [ "and", [ "or", - [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id.protocols.id.ports.id", "equal", "1-65535" ], - [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id.protocols.id", "equal", "ALL" ] + [ "fcu.regions.id.security_groups.id.rules.id.protocols.id.ports.id", "equal", "1-65535" ], + [ "fcu.regions.id.security_groups.id.rules.id.protocols.id", "equal", "ALL" ] ], - [ "ec2.regions.id.vpcs.id.security_groups.id.rules.id", "equal", "ingress"] + [ "fcu.regions.id.security_groups.id.rules.id", "equal", "ingress"] ] } diff --git a/ScoutSuite/providers/osc/rules/findings/fcu-security-group-opens-all-ports.json b/ScoutSuite/providers/osc/rules/findings/fcu-security-group-opens-all-ports.json index 27b401976..ccec791c9 100755 --- a/ScoutSuite/providers/osc/rules/findings/fcu-security-group-opens-all-ports.json +++ b/ScoutSuite/providers/osc/rules/findings/fcu-security-group-opens-all-ports.json @@ -2,8 +2,8 @@ "description": "Security Group Opens All Ports", "rationale": "It was detected that all ports in the security group are open, which creates a wider attack surface for resources assigned to it. Open ports should be reduced to the minimum needed to correctly operate.", "dashboard_name": "Rules", - "display_path": "ec2.regions.id.vpcs.id.security_groups.id", - "path": "ec2.regions.id.vpcs.id.security_groups.id.rules.id.protocols.id.ports.id", + "display_path": "fcu.regions.id.security_groups.id", + "path": "fcu.regions.id.security_groups.id.rules.id.protocols.id.ports.id", "conditions": [ "and", [ From 34bc5493f9ea9eb9f52d09fb570d7252db9e75af Mon Sep 17 00:00:00 2001 From: Tio Gobin Date: Fri, 7 Aug 2020 12:05:57 +0200 Subject: [PATCH 19/21] Authentication through profile, access_key/secret_key, default .oapi_credentials --- ScoutSuite/__main__.py | 16 ++++----- ScoutSuite/core/cli_parser.py | 7 ++++ .../providers/osc/authentication_strategy.py | 33 +++++++++++-------- 3 files changed, 33 insertions(+), 23 deletions(-) diff --git a/ScoutSuite/__main__.py b/ScoutSuite/__main__.py index 351638829..7b30537bc 100755 --- a/ScoutSuite/__main__.py +++ b/ScoutSuite/__main__.py @@ -18,7 +18,7 @@ from ScoutSuite.output.utils import get_filename from ScoutSuite.providers import get_provider from ScoutSuite.providers.base.authentication_strategy_factory import get_authentication_strategy - +import logging def run_from_cli(): parser = ScoutSuiteArgumentParser() @@ -26,6 +26,7 @@ def run_from_cli(): # Get the dictionary to get None instead of a crash args = args.__dict__ + logging.warning (args) # TODO provider-specific arguments should be prepended with the provider's code # (e.g. aws_profile, azure_user_account) @@ -54,8 +55,7 @@ def run_from_cli(): # Aliyun access_key_id=args.get('access_key_id'), access_key_secret=args.get('access_key_secret'), # Outscale - osc_access_key=args.get('osc_access_key'), - osc_secret_access_key=args.get('osc_secret_access_key'), + access=args.get('access'), # General report_name=args.get('report_name'), report_dir=args.get('report_dir'), timestamp=args.get('timestamp'), @@ -103,7 +103,7 @@ def run(provider, # Aliyun access_key_id=None, access_key_secret=None, # Outscale - osc_access_key=None, osc_secret_access_key=None, + access=None, # General report_name=None, report_dir=None, timestamp=False, @@ -157,8 +157,7 @@ async def _run(provider, # Aliyun access_key_id, access_key_secret, # Outscale - osc_access_key, - osc_secret_access_key, + access, # General report_name, report_dir, timestamp, @@ -205,10 +204,9 @@ async def _run(provider, client_secret=client_secret, username=username, password=password, + access=access, access_key_id=access_key_id, - access_key_secret=access_key_secret, - osc_access_key=osc_access_key, - osc_secret_access_key=osc_secret_access_key) + access_key_secret=access_key_secret) if not credentials: return 101 diff --git a/ScoutSuite/core/cli_parser.py b/ScoutSuite/core/cli_parser.py index 88a3d9f22..031f3794d 100755 --- a/ScoutSuite/core/cli_parser.py +++ b/ScoutSuite/core/cli_parser.py @@ -385,6 +385,13 @@ def _init_osc_parser(self): default=None, help='Run with a named profile') + osc_parser.add_argument('--access', + dest='access', + nargs='+', + default=None, + help='Run with access keys') + + def parse_args(self, args=None): args = self.parser.parse_args(args) diff --git a/ScoutSuite/providers/osc/authentication_strategy.py b/ScoutSuite/providers/osc/authentication_strategy.py index db4c7b56a..c2dbe2024 100644 --- a/ScoutSuite/providers/osc/authentication_strategy.py +++ b/ScoutSuite/providers/osc/authentication_strategy.py @@ -13,22 +13,27 @@ # See the License for the specific language governing permissions and # limitations under the License. -from datetime import datetime -import hashlib -import hmac -from urllib.parse import quote as urlquote -import requests -import json -# from ScoutSuite.providers.osc.utils import urlquote from ScoutSuite.providers.base.authentication_strategy import AuthenticationStrategy, AuthenticationException from osc_sdk_python import Gateway class OutscaleAuthenticationStrategy(AuthenticationStrategy): - def authenticate(self, profile=None, osc_access_key=None, - osc_secret_access_key=None, **kwargs): - try: - session = Gateway() - return session - except Exception as e: - raise AuthenticationException(e) + def authenticate(self, profile=None, access=None, **kwargs): + if profile: + try: + session = Gateway(**{"profile": profile}) + session.ReadVms() + except Exception as e: + raise AuthenticationException(e) + elif access: + session = Gateway({"custom": { + "access_key": access[0], + "secret_key": access[1], + "region": "eu-west-2" + }}) + else: + try: + session = Gateway() + except Exception as e: + raise AuthenticationException(e) + return session \ No newline at end of file From 33fee7d1adb38181025fa1911fa2ada7c0dc058d Mon Sep 17 00:00:00 2001 From: Tio Gobin Date: Fri, 7 Aug 2020 13:37:16 +0200 Subject: [PATCH 20/21] Removed useless logger --- ScoutSuite/__main__.py | 2 - ScoutSuite/providers/osc/facade/base.py | 5 --- ScoutSuite/providers/osc/facade/fcu.py | 13 +++--- ScoutSuite/providers/osc/facade/utils.py | 9 +++++ .../providers/osc/resources/fcu/base.py | 24 ++--------- .../osc/resources/fcu/securitygroups.py | 5 --- .../providers/osc/resources/fcu/volumes.py | 40 +++++++++++++++++++ ScoutSuite/providers/osc/resources/regions.py | 4 +- 8 files changed, 61 insertions(+), 41 deletions(-) create mode 100644 ScoutSuite/providers/osc/resources/fcu/volumes.py diff --git a/ScoutSuite/__main__.py b/ScoutSuite/__main__.py index 7b30537bc..9fdb4234e 100755 --- a/ScoutSuite/__main__.py +++ b/ScoutSuite/__main__.py @@ -18,7 +18,6 @@ from ScoutSuite.output.utils import get_filename from ScoutSuite.providers import get_provider from ScoutSuite.providers.base.authentication_strategy_factory import get_authentication_strategy -import logging def run_from_cli(): parser = ScoutSuiteArgumentParser() @@ -26,7 +25,6 @@ def run_from_cli(): # Get the dictionary to get None instead of a crash args = args.__dict__ - logging.warning (args) # TODO provider-specific arguments should be prepended with the provider's code # (e.g. aws_profile, azure_user_account) diff --git a/ScoutSuite/providers/osc/facade/base.py b/ScoutSuite/providers/osc/facade/base.py index 36bcefcc0..11617d90b 100644 --- a/ScoutSuite/providers/osc/facade/base.py +++ b/ScoutSuite/providers/osc/facade/base.py @@ -6,11 +6,6 @@ class OSCFacade(OSCBaseFacade): def __init__(self, credentials=None): super(OSCFacade, self).__init__() - import logging - logging.getLogger('scout').critical("OSC ::: OSCFacade::__init__()") - logging.getLogger('scout').critical(f"credentials {credentials}") - logging.getLogger('scout').critical(f"session {credentials.session}") - # self.session = credentials.session self.session = credentials self._instantiate_facades() diff --git a/ScoutSuite/providers/osc/facade/fcu.py b/ScoutSuite/providers/osc/facade/fcu.py index 6a37b8231..4444e68ff 100644 --- a/ScoutSuite/providers/osc/facade/fcu.py +++ b/ScoutSuite/providers/osc/facade/fcu.py @@ -18,14 +18,17 @@ def __init__(self, session: Gateway): super(FCUFacade, self).__init__(session) async def get_security_groups(self, region: str, vpc: str = None): - import logging - logging.getLogger('scout').critical("OSC ::: FCUFacade::get_security_groups()") try: - # return await OSCFacadeUtils.get_all_pages( - # 'fcu', region, self.session, 'describe_security_groups', 'SecurityGroups', Filters=filters - # ) security_groups = await OSCFacadeUtils.get_all_security_groups(self.session) return security_groups except Exception as e: print_exception('Failed to describe FCU security groups: {}'.format(e)) return [] + + async def get_volumes(self, region: str, vpc: str = None): + try: + volumes = await OSCFacadeUtils.get_all_volumes(self.session) + return volumes + except Exception as e: + print_exception('Failed to describe FCU volumes: {}') + return [] diff --git a/ScoutSuite/providers/osc/facade/utils.py b/ScoutSuite/providers/osc/facade/utils.py index 7498d0c13..7630e37fa 100644 --- a/ScoutSuite/providers/osc/facade/utils.py +++ b/ScoutSuite/providers/osc/facade/utils.py @@ -11,6 +11,15 @@ async def get_all_security_groups(session: Gateway): security_groups.append(security_group) return security_groups + @staticmethod + async def get_all_volumes(session: Gateway): + response = session.ReadVolumes() + volumes = [] + if 'Volumes' in response: + for volume in response['Volumes']: + volumes.append(volume) + return volumes + @staticmethod def _get_outscale_endpoint(region, version, action): diff --git a/ScoutSuite/providers/osc/resources/fcu/base.py b/ScoutSuite/providers/osc/resources/fcu/base.py index 41bf82e3f..8fbeea6c7 100644 --- a/ScoutSuite/providers/osc/resources/fcu/base.py +++ b/ScoutSuite/providers/osc/resources/fcu/base.py @@ -3,6 +3,7 @@ # from ScoutSuite.providers.osc.resources.fcu.volumes import Volumes # from ScoutSuite.providers.osc.resources.fcu.vpcs import FcuVpcs from ScoutSuite.providers.osc.resources.fcu.securitygroups import SecurityGroups +from ScoutSuite.providers.osc.resources.fcu.volumes import Volumes from ScoutSuite.providers.osc.resources.regions import Regions class FCU(Regions): @@ -16,31 +17,12 @@ class FCU(Regions): def __init__(self, facade): super(FCU, self).__init__('fcu', facade) - import logging - logging.getLogger("scout").critical("OSC ::: Ressource FCU\n\n\n\n\n") async def fetch_all(self, regions=None, excluded_regions=None, partition_name='osc', **kwargs): - # await super(FCU, self).fetch_all(regions, excluded_regions, partition_name) - import logging - logging.getLogger("scout").critical("OSC ::: FCU.fetch_all()\n\n\n") await super(FCU, self).fetch_all(regions, excluded_regions) - logging.getLogger("scout").critical("OSC ::: ! FCU.fetch_all()\n\n\n") - - logging.getLogger("scout").critical("Regions :::") - logging.getLogger("scout").critical(self['regions']) for region in self['regions']: - logging.getLogger("scout").critical(f"OSC ::: region :: {region}") - logging.getLogger("scout").critical(f"OSC ::: {self['regions'][region]}") - # logging.getLogger("scout").critical(self['regions'][region]['security_groups'].values()) self['regions'][region]['security_groups_count'] =\ sum([len(sg) for sg in self['regions'][region]['security_groups'].values()]) - # self['regions'][region]['instances_count'] =\ - # sum([len(vpc['instances']) for vpc in self['regions'][region]['vpcs'].values()]) - # self['regions'][region]['security_groups_count'] =\ - # sum([len(vpc['security_groups']) for vpc in self['regions'][region]['vpcs'].values()]) - # self['regions'][region]['network_interfaces_count'] =\ - # sum([len(vpc['network_interfaces']) for vpc in self['regions'][region]['vpcs'].values()]) - - # self['instances_count'] = sum([region['instances_count'] for region in self['regions'].values()]) + self['regions'][region]['volumes_count'] =\ + sum([len(volumes['volumes']) for volumes in self['regions'][region]['volumes'].values()]) self['security_groups_count'] = sum([region['security_groups_count'] for region in self['regions'].values()]) - # self['network_interfaces_count'] = sum([region['network_interfaces_count'] for region in self['regions'].values()]) diff --git a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py index 711e87a6e..65008eee7 100644 --- a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py +++ b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py @@ -7,16 +7,13 @@ class SecurityGroups(OSCResources): def __init__(self, facade: OSCFacade, region: str, vpc: str = None): - logging.getLogger("scout").critical("OSC ::: Security Groups\n\n\n\n\n") super(SecurityGroups, self).__init__(facade) self.region = region self.vpc = vpc async def fetch_all(self): try: - logging.getLogger("scout").critical("OSC ::: SecurityGroups.fetch_all()") raw_security_groups = await self.facade.fcu.get_security_groups(self.region) - logging.getLogger("scout").critical(f"OSC ::: security groups {raw_security_groups}") for raw_security_group in raw_security_groups: name, resource = self._parse_security_group(raw_security_group) self[name] = resource @@ -24,10 +21,8 @@ async def fetch_all(self): logging.getLogger("scout").critical(f"OSC ::: SecurityGroups _fecth_all() Exception {e}\n\n\n") def _parse_security_group(self, raw_security_group): - import logging security_group = {} security_group['name'] = raw_security_group['SecurityGroupName'] - logging.getLogger("scout").critical("OSC ::: 000") security_group['id'] = raw_security_group['SecurityGroupId'] security_group['description'] = raw_security_group['Description'] security_group['owner_id'] = raw_security_group['AccountId'] diff --git a/ScoutSuite/providers/osc/resources/fcu/volumes.py b/ScoutSuite/providers/osc/resources/fcu/volumes.py new file mode 100644 index 000000000..d814dab25 --- /dev/null +++ b/ScoutSuite/providers/osc/resources/fcu/volumes.py @@ -0,0 +1,40 @@ +from ScoutSuite.providers.osc.resources.base import OSCResources +from ScoutSuite.providers.osc.facade.base import OSCFacade +from ScoutSuite.utils import manage_dictionary + +import logging + + +class Volumes(OSCResources): + def __init__(self, facade: OSCFacade, region: str, vpc: str = None): + super(Volumes, self).__init__(facade) + self.region = region + self.vpc = vpc + + async def fetch_all(self, regions=None, excluded_regions=None, partition_name='osc', **kwargs): + try: + raw_volumes = await self.facade.fcu.get_volumes(self.region) + for raw_volume in raw_volumes: + name, resource = self._parse_volumes(raw_volume) + self[name] = resource + except Exception as e: + logging.warning(e) + + def _parse_volume(self, raw_volume): + volume = {} + volume['size'] = raw_volume['Size'] + volume['id'] = raw_volume['VolumeId'] + volume['type'] = raw_volume['VolumeType'] + volume['snapshot_id'] = raw_volume['SnapshotId'] + volume['state'] = raw_volume['State'] + volume["rules"] = [] + return volume['id'], volume + + def _parse_volume_rules(self, rules): + protocols = {} + rules_count = 0 + for rule in rules: + # @TODO find ome rule to put here + rules_count += 1 + + return protocols, rules_count diff --git a/ScoutSuite/providers/osc/resources/regions.py b/ScoutSuite/providers/osc/resources/regions.py index 3d7f77e1b..70ce57b79 100644 --- a/ScoutSuite/providers/osc/resources/regions.py +++ b/ScoutSuite/providers/osc/resources/regions.py @@ -2,7 +2,7 @@ from ScoutSuite.providers.osc.resources.base import OSCCompositeResources from ScoutSuite.providers.osc.facade.base import OSCFacade - +import logging class Regions(OSCCompositeResources, metaclass=abc.ABCMeta): @@ -11,8 +11,6 @@ def __init__(self, service: str, facade: OSCFacade): self.service = service async def fetch_all(self, regions=None, excluded_regions=None, **kwargs): - import logging - logging.getLogger("scout").critical("OSC ::: Regions::fetch_all()") try: self['regions'] = {} for region in await self.facade.build_region_list(self.service, regions, excluded_regions): From 35bfc55e5f62f9823e12bae3c083766d514265ee Mon Sep 17 00:00:00 2001 From: Tio Gobin Date: Fri, 7 Aug 2020 14:32:17 +0200 Subject: [PATCH 21/21] Deleted some unused import --- ScoutSuite/providers/osc/facade/base.py | 5 ++--- ScoutSuite/providers/osc/facade/basefacade.py | 1 - ScoutSuite/providers/osc/facade/fcu.py | 11 ++--------- ScoutSuite/providers/osc/resources/base.py | 5 +---- ScoutSuite/providers/osc/resources/fcu/base.py | 10 ++-------- .../providers/osc/resources/fcu/securitygroups.py | 1 - ScoutSuite/providers/osc/resources/fcu/volumes.py | 2 +- ScoutSuite/providers/osc/resources/regions.py | 2 +- 8 files changed, 9 insertions(+), 28 deletions(-) diff --git a/ScoutSuite/providers/osc/facade/base.py b/ScoutSuite/providers/osc/facade/base.py index 11617d90b..309724de5 100644 --- a/ScoutSuite/providers/osc/facade/base.py +++ b/ScoutSuite/providers/osc/facade/base.py @@ -1,16 +1,15 @@ from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade -# from ScoutSuite.providers.osc.facade.api import ApiFacade from ScoutSuite.providers.osc.facade.fcu import FCUFacade import requests + class OSCFacade(OSCBaseFacade): def __init__(self, credentials=None): super(OSCFacade, self).__init__() self.session = credentials self._instantiate_facades() - async def build_region_list(self, service: str, chosen_regions=None, - excluded_regions=None, partition_name='osc'): + async def build_region_list(self, chosen_regions=None, excluded_regions=None): regions = requests.post( "https://api.eu-west-2.outscale.com/api/latest/ReadRegions").json()["Regions"] regions_list = [] diff --git a/ScoutSuite/providers/osc/facade/basefacade.py b/ScoutSuite/providers/osc/facade/basefacade.py index df22891ae..9c5eb4cd0 100644 --- a/ScoutSuite/providers/osc/facade/basefacade.py +++ b/ScoutSuite/providers/osc/facade/basefacade.py @@ -1,5 +1,4 @@ from osc_sdk_python import Gateway -import logging class OSCBaseFacade(object): def __init__(self, session: Gateway = None): diff --git a/ScoutSuite/providers/osc/facade/fcu.py b/ScoutSuite/providers/osc/facade/fcu.py index 4444e68ff..a5105cdd2 100644 --- a/ScoutSuite/providers/osc/facade/fcu.py +++ b/ScoutSuite/providers/osc/facade/fcu.py @@ -1,19 +1,12 @@ -import asyncio -import base64 from osc_sdk_python import Gateway -import zlib from ScoutSuite.core.console import print_exception from ScoutSuite.providers.osc.facade.basefacade import OSCBaseFacade from ScoutSuite.providers.osc.facade.utils import OSCFacadeUtils -from ScoutSuite.providers.utils import get_and_set_concurrently -from ScoutSuite.providers.utils import run_concurrently class FCUFacade(OSCBaseFacade): def __init__(self, session: Gateway): - # def __init__(self, session: Gateway, owner_id: str): - # self.owner_id = owner_id self.session = session super(FCUFacade, self).__init__(session) @@ -25,10 +18,10 @@ async def get_security_groups(self, region: str, vpc: str = None): print_exception('Failed to describe FCU security groups: {}'.format(e)) return [] - async def get_volumes(self, region: str, vpc: str = None): + async def get_volumes(self): try: volumes = await OSCFacadeUtils.get_all_volumes(self.session) return volumes except Exception as e: - print_exception('Failed to describe FCU volumes: {}') + print_exception('Failed to describe FCU volumes: {}'.format(e)) return [] diff --git a/ScoutSuite/providers/osc/resources/base.py b/ScoutSuite/providers/osc/resources/base.py index d68b8ee0f..4fd2f0298 100644 --- a/ScoutSuite/providers/osc/resources/base.py +++ b/ScoutSuite/providers/osc/resources/base.py @@ -6,11 +6,8 @@ class OSCResources(Resources, metaclass=abc.ABCMeta): """This is the base class for OSC resources.""" - pass -class OSCCompositeResources(OSCResources, CompositeResources, - metaclass=abc.ABCMeta): - +class OSCCompositeResources(OSCResources, CompositeResources, metaclass=abc.ABCMeta): pass \ No newline at end of file diff --git a/ScoutSuite/providers/osc/resources/fcu/base.py b/ScoutSuite/providers/osc/resources/fcu/base.py index 8fbeea6c7..d049696a9 100644 --- a/ScoutSuite/providers/osc/resources/fcu/base.py +++ b/ScoutSuite/providers/osc/resources/fcu/base.py @@ -1,17 +1,11 @@ -# from ScoutSuite.providers.osc.resources.fcu.ami import OutscaleMachineImages -# from ScoutSuite.providers.osc.resources.fcu.snapshots import Snapshots -# from ScoutSuite.providers.osc.resources.fcu.volumes import Volumes -# from ScoutSuite.providers.osc.resources.fcu.vpcs import FcuVpcs from ScoutSuite.providers.osc.resources.fcu.securitygroups import SecurityGroups -from ScoutSuite.providers.osc.resources.fcu.volumes import Volumes from ScoutSuite.providers.osc.resources.regions import Regions +from ScoutSuite.providers.osc.resources.fcu.volumes import Volumes + class FCU(Regions): _children = [ (SecurityGroups, 'security_groups') - # (FcuVpcs, 'vpcs'), - # (OutscaleMachineImages, 'omis'), - # (Snapshots, 'snapshots'), # (Volumes, 'volumes') ] diff --git a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py index 65008eee7..b827c3f68 100644 --- a/ScoutSuite/providers/osc/resources/fcu/securitygroups.py +++ b/ScoutSuite/providers/osc/resources/fcu/securitygroups.py @@ -1,7 +1,6 @@ from ScoutSuite.providers.osc.resources.base import OSCResources from ScoutSuite.providers.osc.facade.base import OSCFacade from ScoutSuite.utils import manage_dictionary -from ScoutSuite.core.fs import load_data import logging diff --git a/ScoutSuite/providers/osc/resources/fcu/volumes.py b/ScoutSuite/providers/osc/resources/fcu/volumes.py index d814dab25..275c4d80d 100644 --- a/ScoutSuite/providers/osc/resources/fcu/volumes.py +++ b/ScoutSuite/providers/osc/resources/fcu/volumes.py @@ -13,7 +13,7 @@ def __init__(self, facade: OSCFacade, region: str, vpc: str = None): async def fetch_all(self, regions=None, excluded_regions=None, partition_name='osc', **kwargs): try: - raw_volumes = await self.facade.fcu.get_volumes(self.region) + raw_volumes = await self.facade.fcu.get_volumes() for raw_volume in raw_volumes: name, resource = self._parse_volumes(raw_volume) self[name] = resource diff --git a/ScoutSuite/providers/osc/resources/regions.py b/ScoutSuite/providers/osc/resources/regions.py index 70ce57b79..33c212ddc 100644 --- a/ScoutSuite/providers/osc/resources/regions.py +++ b/ScoutSuite/providers/osc/resources/regions.py @@ -13,7 +13,7 @@ def __init__(self, service: str, facade: OSCFacade): async def fetch_all(self, regions=None, excluded_regions=None, **kwargs): try: self['regions'] = {} - for region in await self.facade.build_region_list(self.service, regions, excluded_regions): + for region in await self.facade.build_region_list(regions, excluded_regions): self['regions'][region['RegionName']] = { 'id': region['RegionName'], 'region': region,