Skip to content

Commit e3d4935

Browse files
chrisyoonullifychrisyoonullify
committed
more flexible include_only and ignore rules
1 parent 5b3bac6 commit e3d4935

File tree

5 files changed

+182
-40
lines changed

5 files changed

+182
-40
lines changed

‎examples/nullify.yaml‎

Lines changed: 40 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,28 @@ code:
6262
- config-file-parser
6363
- dast-action
6464
- cli
65-
- rule_ids: [ python-sql-injection ]
65+
- rule_ids: [ python-sqlAttackSurface: &models.AttackSurface{
66+
Enable: true,
67+
EnableDNSEnumeration: true,
68+
DomainNames: []string{"172.36.255.7", "example.com"},
69+
PathPrefixes: []string{"/vuln"},
70+
Ignore: []models.AttackSurfaceIgnore{
71+
{
72+
HTTPMethods: []string{"DELETE"},
73+
},
74+
{
75+
HTTPMethods: []string{"jira.example.com"},
76+
},
77+
{
78+
DomainNames: []string{"*.testing.example.com"},
79+
Ports: []int{8080, 8088, 9999},
80+
},
81+
{
82+
DomainNames: []string{"dev.*", "staging.*"},
83+
HTTPMethods: []string{"POST", "PUT"},
84+
},
85+
},
86+
},-injection ]
6687
reason: This code won't be going live until next year but we should fix it before then
6788
expiry: "2021-12-31"
6889
dependencies:
@@ -112,10 +133,21 @@ integrations:
112133
name: John Smith
113134
attack_surface:
114135
enable: true
115-
enable_dns_enumeration: false
116-
domain_names: [172.36.255.7,example.com]
117-
ignore_domain_names: []
118-
path_prefixes: [/vuln]
119-
ignore_methods: [POST,DELETE]
120-
ignore_ports: [8080]
121-
schemes: ["http","https"]
136+
enable_dns_enumeration: true
137+
ip_addresses: [10.11.12.13, 100.110.120.0/24, 10.0.0.1-254]
138+
domain_names: [example.com, prod.hosting.com]
139+
include_only:
140+
- domain_names: [live.prod.hosting.com]
141+
http:
142+
paths: [/main, /api/**/create]
143+
ignore:
144+
- http:
145+
methods: [DELETE]
146+
- domain_names: [jira.example.com, "*.testing.example.com"]
147+
- ip_addresses: [100.110.120.130]
148+
transport_protocols: [tcp]
149+
ports: [22, 8080, 9990-9999]
150+
- domain_names: ["dev.*", "staging.*"]
151+
http:
152+
paths: [/auth]
153+
methods: [POST]

‎pkg/merger/merger_test.go‎

Lines changed: 64 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -340,12 +340,38 @@ func TestMergeConfigFiles(t *testing.T) {
340340
AttackSurface: &models.AttackSurface{
341341
Enable: true,
342342
EnableDNSEnumeration: true,
343-
DomainNames: []string{"example.com"},
344-
IgnoreDomainNames: []string{"example2.com"},
345-
PathPrefixes: []string{"/vuln"},
346-
IgnoreMethods: []string{"POST", "DELETE"},
347-
IgnorePorts: []int{8080},
348-
Schemes: []string{"http", "https"},
343+
IPAddresses: []string{"10.11.12.13", "100.110.120.0/24", "10.0.0.1-254"},
344+
DomainNames: []string{"example.com", "prod.hosting.com"},
345+
IncludeOnly: []models.AttackSurfaceIncludeOnly{
346+
{
347+
DomainNames: []string{"live.prod.hosting.com"},
348+
HTTP: &models.HTTPAttackSurfaceIncludeOnly{
349+
Paths: []string{"/main", "/api/**/create"},
350+
},
351+
},
352+
},
353+
Ignore: []models.AttackSurfaceIgnore{
354+
{
355+
HTTP: &models.HTTPAttackSurfaceIgnore{
356+
Methods: []string{"DELETE"},
357+
},
358+
},
359+
{
360+
DomainNames: []string{"jira.example.com", "*.testing.example.com"},
361+
},
362+
{
363+
IPAddresses: []string{"100.110.120.130"},
364+
TransportProtocols: []string{"tcp"},
365+
Ports: []string{"22", "8080", "9990-9999"},
366+
},
367+
{
368+
DomainNames: []string{"dev.*", "staging.*"},
369+
HTTP: &models.HTTPAttackSurfaceIgnore{
370+
Paths: []string{"/auth"},
371+
Methods: []string{"POST"},
372+
},
373+
},
374+
},
349375
},
350376
},
351377
repoConfig: nil,
@@ -357,12 +383,38 @@ func TestMergeConfigFiles(t *testing.T) {
357383
AttackSurface: &models.AttackSurface{
358384
Enable: true,
359385
EnableDNSEnumeration: true,
360-
DomainNames: []string{"example.com"},
361-
IgnoreDomainNames: []string{"example2.com"},
362-
PathPrefixes: []string{"/vuln"},
363-
IgnoreMethods: []string{"POST", "DELETE"},
364-
IgnorePorts: []int{8080},
365-
Schemes: []string{"http", "https"},
386+
IPAddresses: []string{"10.11.12.13", "100.110.120.0/24", "10.0.0.1-254"},
387+
DomainNames: []string{"example.com", "prod.hosting.com"},
388+
IncludeOnly: []models.AttackSurfaceIncludeOnly{
389+
{
390+
DomainNames: []string{"live.prod.hosting.com"},
391+
HTTP: &models.HTTPAttackSurfaceIncludeOnly{
392+
Paths: []string{"/main", "/api/**/create"},
393+
},
394+
},
395+
},
396+
Ignore: []models.AttackSurfaceIgnore{
397+
{
398+
HTTP: &models.HTTPAttackSurfaceIgnore{
399+
Methods: []string{"DELETE"},
400+
},
401+
},
402+
{
403+
DomainNames: []string{"jira.example.com", "*.testing.example.com"},
404+
},
405+
{
406+
IPAddresses: []string{"100.110.120.130"},
407+
TransportProtocols: []string{"tcp"},
408+
Ports: []string{"22", "8080", "9990-9999"},
409+
},
410+
{
411+
DomainNames: []string{"dev.*", "staging.*"},
412+
HTTP: &models.HTTPAttackSurfaceIgnore{
413+
Paths: []string{"/auth"},
414+
Methods: []string{"POST"},
415+
},
416+
},
417+
},
366418
},
367419
},
368420
},

‎pkg/models/attack_surface.go‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,33 @@ package models
22

33
type AttackSurface struct {
44
// global only
5-
Enable bool `yaml:"enable"`
6-
EnableDNSEnumeration bool `yaml:"enable_dns_enumeration"`
7-
DomainNames []string `yaml:"domain_names,omitempty"`
8-
IgnoreDomainNames []string `yaml:"ignore_domain_names,omitempty"`
9-
PathPrefixes []string `yaml:"path_prefixes,omitempty"`
10-
IgnoreMethods []string `yaml:"ignore_methods,omitempty"`
11-
IgnorePorts []int `yaml:"ignore_ports,omitempty"`
12-
Schemes []string `yaml:"schemes"`
5+
Enable bool `yaml:"enable"`
6+
EnableDNSEnumeration bool `yaml:"enable_dns_enumeration"`
7+
IPAddresses []string `yaml:"ip_addresses,omitempty"`
8+
DomainNames []string `yaml:"domain_names,omitempty"`
9+
IncludeOnly []AttackSurfaceIncludeOnly `yaml:"include_only,omitempty"`
10+
Ignore []AttackSurfaceIgnore `yaml:"ignore,omitempty"`
11+
}
12+
13+
type AttackSurfaceIncludeOnly struct {
14+
DomainNames []string `yaml:"domain_names,omitempty"`
15+
HTTP *HTTPAttackSurfaceIncludeOnly `yaml:"http,omitempty"`
16+
}
17+
18+
type HTTPAttackSurfaceIncludeOnly struct {
19+
Paths []string `yaml:"paths,omitempty"`
20+
}
21+
22+
type AttackSurfaceIgnore struct {
23+
// empty fields are equivalent to *
24+
IPAddresses []string `yaml:"ip_addresses,omitempty"`
25+
DomainNames []string `yaml:"domain_names,omitempty"`
26+
TransportProtocols []string `yaml:"transport_protocols,omitempty"`
27+
Ports []string `yaml:"ports,omitempty"`
28+
HTTP *HTTPAttackSurfaceIgnore `yaml:"http,omitempty"`
29+
}
30+
31+
type HTTPAttackSurfaceIgnore struct {
32+
Methods []string `yaml:"methods,omitempty"`
33+
Paths []string `yaml:"paths,omitempty"`
1334
}

‎tests/integration_test.go‎

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -156,12 +156,38 @@ func TestIntegration(t *testing.T) {
156156
AttackSurface: &models.AttackSurface{
157157
Enable: true,
158158
EnableDNSEnumeration: true,
159-
DomainNames: []string{"172.36.255.7", "example.com"},
160-
IgnoreDomainNames: []string{"jira.example.com"},
161-
PathPrefixes: []string{"/vuln"},
162-
IgnoreMethods: []string{"POST", "DELETE"},
163-
IgnorePorts: []int{8080},
164-
Schemes: []string{"http", "https"},
159+
IPAddresses: []string{"10.11.12.13", "100.110.120.0/24", "10.0.0.1-254"},
160+
DomainNames: []string{"example.com", "prod.hosting.com"},
161+
IncludeOnly: []models.AttackSurfaceIncludeOnly{
162+
{
163+
DomainNames: []string{"live.prod.hosting.com"},
164+
HTTP: &models.HTTPAttackSurfaceIncludeOnly{
165+
Paths: []string{"/main", "/api/**/create"},
166+
},
167+
},
168+
},
169+
Ignore: []models.AttackSurfaceIgnore{
170+
{
171+
HTTP: &models.HTTPAttackSurfaceIgnore{
172+
Methods: []string{"DELETE"},
173+
},
174+
},
175+
{
176+
DomainNames: []string{"jira.example.com", "*.testing.example.com"},
177+
},
178+
{
179+
IPAddresses: []string{"100.110.120.130"},
180+
TransportProtocols: []string{"tcp"},
181+
Ports: []string{"22", "8080", "9990-9999"},
182+
},
183+
{
184+
DomainNames: []string{"dev.*", "staging.*"},
185+
HTTP: &models.HTTPAttackSurfaceIgnore{
186+
Paths: []string{"/auth"},
187+
Methods: []string{"POST"},
188+
},
189+
},
190+
},
165191
},
166192
}
167193

‎tests/nullify.yaml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -97,9 +97,20 @@ integrations:
9797
attack_surface:
9898
enable: true
9999
enable_dns_enumeration: true
100-
domain_names: [172.36.255.7,example.com]
101-
ignore_domain_names: [jira.example.com]
102-
path_prefixes: [/vuln]
103-
ignore_methods: [POST,DELETE]
104-
ignore_ports: [8080]
105-
schemes: ["http","https"]
100+
ip_addresses: [10.11.12.13, 100.110.120.0/24, 10.0.0.1-254]
101+
domain_names: [example.com, prod.hosting.com]
102+
include_only:
103+
- domain_names: [live.prod.hosting.com]
104+
http:
105+
paths: [/main, /api/**/create]
106+
ignore:
107+
- http:
108+
methods: [DELETE]
109+
- domain_names: [jira.example.com, "*.testing.example.com"]
110+
- ip_addresses: [100.110.120.130]
111+
transport_protocols: [tcp]
112+
ports: [22, 8080, 9990-9999]
113+
- domain_names: ["dev.*", "staging.*"]
114+
http:
115+
paths: [/auth]
116+
methods: [POST]

0 commit comments

Comments
 (0)