Easy automated vulnerability scanning, reporting and analysis
Latest commit a8ad6ca May 9, 2018
Failed to load latest commit information.
.circleci Back to mysql 5.7 May 9, 2018
bin Fixes #588 and fixes #589 - Thanks @alirezakv Dec 6, 2017
db DB 11 Apr 18, 2018
deb Fixing signature of deb packages (#609) Nov 15, 2017
docker-files Fixes #639 - Logrotate should not rotate logs of services not running ( Feb 12, 2018
docs Copyright fix Jul 12, 2016
etc Tenable.io (#632) Dec 28, 2017
jmvc Fixed spelling of Tenable.io (#640) Feb 7, 2018
lib Do-scan and import-ivi log messages to syslog Nov 1, 2017
obs ppc builds need at lease 1200k of java stack memory Mar 29, 2016
rpm Fixes #635 - Hypnotoad path is incorrect in systemd startup file on C… Feb 7, 2018
scanners Kill logrotate (#644) Mar 2, 2018
t Release 2.48 May 9, 2018
templates Moving mojo to the mail branch and fixing unit tests May 18, 2017
testdata Make unit tests happy again! Jun 23, 2017
.editorconfig Yeah... YML :( Sep 26, 2017
.gitignore Vagrant for testing rpm packages Jun 14, 2017
.mailmap Enter theodoor (#628) Dec 13, 2017
CONTRIBUTING.md Create CONTRIBUTING.md (#624) Dec 12, 2017
ChangeLog.md Release 2.48 May 9, 2018
Dockerfile Credits Apr 10, 2018
LICENSE.txt Added headers to all files possible Mar 11, 2013
Makefile.PL Fixes #639 - Logrotate should not rotate logs of services not running ( Feb 12, 2018
NOTICE.txt Front end is working again via Docker. You can log into the GUI now Jun 6, 2017
README.md Release 2.48 May 9, 2018
SeccubusV2.pm Release 2.48 May 9, 2018
Vagrantfile Fixes #539 Sep 6, 2017
build_all Copyright year fixes Sep 27, 2017
build_jmvc Copyright year fixes Sep 27, 2017
build_jmvc_docs Copyright year fixes Sep 27, 2017
docker-install.sh Fixed some docker related issues Oct 19, 2017
install.pl Adding Perl:Critic to unit tests and fixing it's critique Jun 23, 2017
public Container is now working as it should be! Jun 7, 2017
seccubus.pl Login and logout is working in the GUI as well!! May 30, 2017
unit_test_jmvc Added headers to all files possible Mar 11, 2013


About Seccubus

Seccubus automates regular vulnerability scans with various tools and aids security people in the fast analysis of its output, both on the first scan and on repeated scans.

On repeated scan delta reporting ensures that findings only need to be judged when they first appear in the scan results or when their output changes.

Seccubus 2.x is the only actively developed and maintained branch and all support for Seccubus V1 has officially been dropped.

Seccubus V2 works with the following scanners:

  • Nessus
  • OpenVAS
  • Skipfish
  • Medusa (local and remote)
  • Nikto (local and remote)
  • NMap (local and remote)
  • OWASP-ZAP (local and remote)
  • SSLyze
  • Medusa
  • Qualys SSL labs
  • testssl.sh (local and remote)

For more information visit [www.seccubus.com]

Seccubus Docker container


Running a full stack (db/app/frontend) in a single container. And get an interactive shell

docker run -it seccubus/seccubus /bin/bash

By default the container holds a mysql server that runs and stores data locally. If you want data persistency there are two options:

Connect the container to a remote mysql/MariaDB database with environment viariables:

docker run -e DBHOST=dns.name.of.db.host \
-e DBPOSRT=3306 \
-e DBNAME=name.of.database \
-e DBUSER=db.username \
-e DBPASS=password \
-ti seccubus/seccubus \

Or, mount a data volume with a db directory on it

mkdir data
mmdir data/db
docker run -it seccubus/seccubus -v ($pwd)/data:/opt/seccubus/data /bin/bash

Please be aware that you can only run one container at a time if you mount a local directory on /var/lib/mysql.

Running a scan

There are two ways to run a scan

Starting a scan on an already running container

To start the scan 'ssllabs' in the workspace 'Example' on an already running container, you could run a command like this:

docker exec -ti <containerID or tag> su - seccubus -c "do-scan --workspace Example --scan ssllabs"

Dedicated scan container

The following command will create a new container just for a signle scan and terminate this container after the scan is finised. It starts the scan 'ssllabs' in workspace 'Example' (this workspace is created by default if you use the local mysql database)

docker run -ti seccubus/seccubus scan Example ssllabs

Please be aware that you need some data persistency here or the data will be stored in a local database that will be deleted whent he container terminates. An optional fourth parameter can be given to specify that the scan should only run on a certain weekday, e.g. to only run this scan on Monday, you can specify"

docker run -ti seccubus/seccubus scan Example ssllabs Mon

This is usefull for container ochestration, like e..g Kubernetes cron jobs.

Running a scheduler

You can run a docker container as a scheduler. This will make it run cron and allow your crontab to execute scans.You can populate the crontab by either placing a file called crontab in the /opt/seccubus/data volume or puting the lines of you crontab in evironement variables starting with CRON_

docker run -e "STACK=cron" -e "CRON_1=* 0 * * * bin/do-scan -w Example -s ssllabs" -ti seccubus/seccubus

This will spin up a container that executes scan ssllabs from workspace Example at midnight every night.

You can set the TZ vairable to control the timezone.

Controlling TLS certificates

The Seccubus container is TLS enabled by default. The environment variable TLS controls this behaviour. Of it is set to anything other then yes, TLS is turned off.

There are three ways to control the certificate:

  • Do nothing : Self signed certificates will be generated for you
  • Populate the variables TLSCERT and TLSKEY : The contents will be placed in /opt/seccubus/data/seccubus.pem and /opt/seccubus/data/seccubus.key and used
  • Put the certificates in the files seccubus.pem and seccubus.key on a data volume and mount it on /opt/seccubus/data

Show this help message

docker run -ti seccubus/seccubus help

Default command

If you don't specify a command to docker run

docker run seccubus/seccubus

The web server access log and error log will be tailed to the screen.

Other options

You can set the following environment variables:

  • STACK - Determines which part of the stack is run
    • full - Run everything
    • front - Start apache to serve the html/javascript frontend (this requires that the APIURL variable is set too)
    • api - Start apache to serve the json api at / (starts MariaDB too if required)
    • web - Start apache to serve both the html/javascript frontend and the json
    • perl - Do not start apache, just use this container as an perl backend
  • DBHOST, DBPORT, DBNAME, DBUSER, DBPASS - Database connection parameters
    • If DBHOST/DBPORT are set to the local MariaDB instance is started
  • APIURL - Path to the API url
    • Set this if your set STACK to front to redirect the API calls to an alternative relative or absolute URL.
  • BASEURI - Base URI for seccubus
    • Server the application at the value provided
  • SMTPSERVER - IP address or host name of an SMTP server to be used for notifications
  • SMTPFROM - From address used in notifications
  • TICKETURL_HEAD/TICKETURL_TAIL - If these are set ticket numberrs will be linked to this URL
    • The content of this environment variable will stored in the file /opt/seccubus/.ssh/SSHKEY1 etc.
    • You can use this mechanism to provide ssh keys that are used to start remote scans
  • HTTP_AUTH_HEADER - Set the http authentication header
    • If you are using something like OpenAM to authenticate your users, this allows you to set which http request header contains the user that OpenAM detected
  • TZ - Set the timezone of the container
  • TLS - Controls TLS behaviour yes means TLS is on, otherwise TLS is off. TLS is on by default.
  • JIT_GROUP - Controls JIT provisioning of users
  • CRON_MAIL_TO - Mail cron messages to this addres
  • CRON_* - Add these lines to crontab in alphabetical order

Change log

Changes of this branch vs the latest/previous release

9-5-2018 - v2.48 - Tenable.io compatibility and more

This release is fully compatible with the Tenable.io vulnerability management platform.

Differences with 2.46


  • Seccubus now support Tenable.io as a scanning platform
  • Added parsing of the ROBOT (bleichenbacher) attack to the SSLlabs scanner
  • Added a dev environment example config
  • Increased the size of the scannerparam field in the database

Bug Fixes

  • #635 - Hypnotoad path was set incorrectly in systemd startup script on CentOS 7
  • #642 - Updated readme to address how to run a scan on a running container
  • Fixed an error in the Docker examples in README.md
  • Added zip to the docker image because it is needed for import/export