0x4d31/salt-scannerLinux 취약점 스캐너 — Salt Open 및 Vulners 감사 API 기반, Slack 알림 및 JIRA 통합 포함
Vulners Audit API와 Salt Open을 기반으로 한 Linux 취약점 스캐너로, Slack 알림 및 JIRA 통합 기능을 제공합니다.
Note: Salt Master와 Minion 버전은 일치해야 합니다. Salt-Scanner는 Salt 버전 2016.11.x를 지원합니다. 2017.7.x 버전을 사용하는 경우 salt-scanner.py에서 "expr_form"을 "tgt_type"으로 바꾸세요.
$ ./salt-scanner.py -h
==========================================================
Vulnerability scanner based on Vulners API and Salt Open
_____ _ _ _____
/ ___| | | | / ___|
\ `--. __ _| | |_ \ `--. ___ __ _ _ __ _ __ ___ _ __
`--. \/ _` | | __| `--. \/ __/ _` | '_ \| '_ \ / _ \ '__|
/\__/ / (_| | | |_ /\__/ / (_| (_| | | | | | | | __/ |
\____/ \__,_|_|\__| \____/ \___\__,_|_| |_|_| |_|\___|_|
Salt-Scanner 0.1 / by 0x4D31
==========================================================
usage: salt-scanner.py [-h] [-t TARGET_HOSTS] [-tF {glob,list,grain}]
[-oN OS_NAME] [-oV OS_VERSION]
optional arguments:
-h, --help show this help message and exit
-t TARGET_HOSTS, --target-hosts TARGET_HOSTS
-tF {glob,list,grain}, --target-form {glob,list,grain}
-oN OS_NAME, --os-name OS_NAME
-oV OS_VERSION, --os-version OS_VERSION
$ sudo SLACK_API_TOKEN="EXAMPLETOKEN" ./salt-scanner.py -t "*"
==========================================================
Vulnerability scanner based on Vulners API and Salt Open
_____ _ _ _____
/ ___| | | | / ___|
\ `--. __ _| | |_ \ `--. ___ __ _ _ __ _ __ ___ _ __
`--. \/ _` | | __| `--. \/ __/ _` | '_ \| '_ \ / _ \ '__|
/\__/ / (_| | | |_ /\__/ / (_| (_| | | | | | | | __/ |
\____/ \__,_|_|\__| \____/ \___\__,_|_| |_|_| |_|\___|_|
Salt-Scanner 0.1 / by 0x4D31
==========================================================
+ No default OS is configured. Detecting OS...
+ Detected Operating Systems:
- OS Name: centos, OS Version: 7
+ Getting the Installed Packages...
+ Started Scanning '10.10.10.55'...
- Total Packages: 357
- 6 Vulnerable Packages Found - Severity: Low
+ Started Scanning '10.10.10.56'...
- Total Packages: 392
- 6 Vulnerable Packages Found - Severity: Critical
+ Finished scanning 2 host (target hosts: '*').
2 Hosts are vulnerable!
+ Output file created: 20170622-093138_232826a7-983f-499b-ad96-7b8f1a75c1d7.txt
+ Full report uploaded to Slack
+ JIRA Issue created: VM-16
+ OpsGenie alert created
Salt Grains (예: ec2_tags)를 target_hosts에서 사용할 수도 있습니다:
$ sudo ./salt-scanner.py --target-hosts "ec2_tags:Role:webapp" --target-form grain
[1] Salt in 10 Minutes: https://docs.saltstack.com/en/latest/topics/tutorials/walkthrough.html