merge develop to master to fix #1511, #1540

.github/workflows/testing.yml

@@ -11,15 +11,15 @@ on:
 jobs:
   build:
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     strategy:
       matrix:
-        python-version: [3.6, 3.7, 3.8]
+        python-version: [3.9, 3.10, 3.11]
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
     - name: Cache pip
@@ -52,4 +52,4 @@ jobs:
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@v1
       with:
-        file: ./coverage.xml
+        file: ./coverage.xml

MANIFEST.in

@@ -13,3 +13,5 @@ recursive-include ScoutSuite/providers/aliyun *
 recursive-include ScoutSuite/providers/aliyun/rules *
 recursive-include ScoutSuite/providers/oci *
 recursive-include ScoutSuite/providers/oci/rules *
+recursive-include ScoutSuite/providers/kubernetes *
+recursive-include ScoutSuite/providers/kubernetes/rules *

README.md

@@ -29,6 +29,7 @@ The following cloud providers are currently supported:
 - Google Cloud Platform
 - Alibaba Cloud (alpha)
 - Oracle Cloud Infrastructure (alpha)
+- Kubernetes clusters on a cloud provider (alpha)
 
 ## Installation
 
@@ -64,3 +65,5 @@ Additional details can be found in the [wiki](https://github.com/nccgroup/ScoutS
 
 **NCC Scout now has a free tier under our "Freemium" offering**. 
 This offering provides access to NCC Group’s extended rulesets, keeping your cloud environment protected in-line with best practice configuration and cloud technologies. To sign up for the service, head on to https://cyberstore.nccgroup.com/our-services/service-details/16/cloud-account-monitoring.
+
+

ScoutSuite/__init__.py

@@ -1,5 +1,5 @@
 __author__ = 'NCC Group'
-__version__ = '5.12.0'
+__version__ = '5.13.0RC1'
 
 ERRORS_LIST = []
 

ScoutSuite/__main__.py

@@ -17,6 +17,9 @@
 from ScoutSuite.output.utils import get_filename
 from ScoutSuite.providers import get_provider
 from ScoutSuite.providers.base.authentication_strategy_factory import get_authentication_strategy
+# Dirty workaround for compatibility with Python >= 3.10
+import collections
+collections.Callable = collections.abc.Callable
 
 
 def run_from_cli():
@@ -52,6 +55,12 @@ def run_from_cli():
                    organization_id=args.get('organization_id'), all_projects=args.get('all_projects'),
                    # Aliyun
                    access_key_id=args.get('access_key_id'), access_key_secret=args.get('access_key_secret'),
+                   # Kubernetes
+                   kubernetes_cluster_provider=args.get('kubernetes_cluster_provider'),
+                   kubernetes_config_file=args.get('kubernetes_config_file'),
+                   kubernetes_context=args.get('kubernetes_context'),
+                   kubernetes_persist_config=args.get('kubernetes_persist_config'),
+                   kubernetes_azure_subscription_id=args.get('kubernetes_azure_subscription_id'),
                    # General
                    report_name=args.get('report_name'), report_dir=args.get('report_dir'),
                    timestamp=args.get('timestamp'),
@@ -98,6 +107,12 @@ def run(provider,
         project_id=None, folder_id=None, organization_id=None, all_projects=False,
         # Aliyun
         access_key_id=None, access_key_secret=None,
+        # Kubernetes
+        kubernetes_cluster_provider=None,
+        kubernetes_config_file=None,
+        kubernetes_context=None,
+        kubernetes_persist_config=True,
+        kubernetes_azure_subscription_id=None,
         # General
         report_name=None, report_dir=None,
         timestamp=False,
@@ -150,6 +165,12 @@ async def _run(provider,
                project_id, folder_id, organization_id, all_projects,
                # Aliyun
                access_key_id, access_key_secret,
+               # Kubernetes
+               kubernetes_cluster_provider,
+               kubernetes_config_file,
+               kubernetes_context,
+               kubernetes_persist_config,
+               kubernetes_azure_subscription_id,
                # General
                report_name, report_dir,
                timestamp,
@@ -198,7 +219,15 @@ async def _run(provider,
                                                  username=username,
                                                  password=password,
                                                  access_key_id=access_key_id,
-                                                 access_key_secret=access_key_secret)
+                                                 access_key_secret=access_key_secret,
+
+                                                 # Kubernetes
+                                                 kubernetes_cluster_provider=kubernetes_cluster_provider,
+                                                 kubernetes_config_file=kubernetes_config_file,
+                                                 kubernetes_context=kubernetes_context,
+                                                 kubernetes_persist_config=kubernetes_persist_config,
+                                                 kubernetes_azure_subscription_id=kubernetes_azure_subscription_id,
+                                                 kubernetes_fetch_local=fetch_local)
 
         if not credentials:
             return 101
@@ -219,6 +248,10 @@ async def _run(provider,
                                       folder_id=folder_id,
                                       organization_id=organization_id,
                                       all_projects=all_projects,
+                                      # Kubernetes
+                                      kubernetes_config_file=kubernetes_config_file,
+                                      kubernetes_context=kubernetes_context,
+                                      kubernetes_cluster_provider=kubernetes_cluster_provider,
                                       # Other
                                       report_dir=report_dir,
                                       timestamp=timestamp,

ScoutSuite/core/cli_parser.py

@@ -29,6 +29,7 @@ def __init__(self):
         self._init_azure_parser()
         self._init_aliyun_parser()
         self._init_oci_parser()
+        self._init_kubernetes_parser()
 
     def _init_aws_parser(self):
         parser = self.subparsers.add_parser("aws",
@@ -254,6 +255,37 @@ def _init_oci_parser(self):
                             default=None,
                             help='Name of the profile')
 
+    def _init_kubernetes_parser(self):
+        kubernetes_parser = self.subparsers.add_parser("kubernetes",
+                                                       parents=[self.common_providers_args_parser],
+                                                       help="Run Scout against a Kubernetes cluster")
+
+        kubernetes_scope = kubernetes_parser.add_argument_group('Additional arguments')
+
+        kubernetes_scope.add_argument('-c',
+                                      '--cluster-provider',
+                                      dest='kubernetes_cluster_provider',
+                                      default=None,
+                                      choices=['aks', 'eks', 'gke'],
+                                      help='Cluster contexts to scan. If no cloud provider is specified, ScoutSuite will use the default Kubernetes configuration.')
+        kubernetes_scope.add_argument('--config-file',
+                                      dest='kubernetes_config_file',
+                                      default=None,
+                                      help='Name of the kube-config file. By default, it will use Kubernetes\' default directory.')
+        kubernetes_scope.add_argument('--context',
+                                      dest='kubernetes_context',
+                                      default=None,
+                                      help='Cluster context to scan. By default, current_context from config file will be used.')
+        kubernetes_scope.add_argument('--do-not-persist-config',
+                                      dest='kubernetes_persist_config',
+                                      action='store_false',
+                                      default=True,
+                                      help='If specified, config file will NOT be updated when changed (e.g GCP token refresh).')
+        kubernetes_scope.add_argument('--subscription-id',
+                                      dest='kubernetes_azure_subscription_id',
+                                      action='store',
+                                      default=None,
+                                      help='If unspecified, the default subscription will be used.')
 
     def _init_common_args_parser(self):
         parser = self.common_providers_args_parser.add_argument_group('Scout Arguments')
@@ -404,4 +436,15 @@ def parse_args(self, args=None):
             if v.get('subscription_ids') and v.get('all_subscriptions'):
                 self.parser.error('--subscription-ids and --all-subscriptions are mutually exclusive options')
 
+        # Kubernetes
+        elif v.get('provider') == 'kubernetes':
+            cluster_provider = v.get('kubernetes_cluster_provider')
+            # change ruleset based on cluster provider
+            if cluster_provider:
+                args.ruleset = f'{cluster_provider}.json'
+
+            # only use subscription_id if kubernetes_cluster_provider is 'aks'
+            if cluster_provider != 'aks' and v.get('kubernetes_azure_subscription_id'):
+                self.parser.error('--subscription-id is only used when analyzing AKS clusters')
+
         return args

ScoutSuite/output/data/html/partials/aws/services.elb.regions.id.vpcs.id.elbs.html

@@ -24,7 +24,7 @@ <h4>Listeners</h4>
             <ul>
                 {{#each listeners}}
                     <li class="list-group-item-text">
-                        {{@key}} ({{Protocol}}{{#if SslPolicy}}, {{SslPolicy}}{{/if}})
+                      <span id="elb.regions.{{../region}}.vpcs.{{../vpc}}.elbs.{{@../key}}.listeners.{{@key}}">{{@key}} ({{Protocol}}{{#if SslPolicy}}, {{SslPolicy}}{{/if}})</span>
                     </li>
                 {{/each}}
           </ul>

ScoutSuite/output/data/html/partials/aws/services.elbv2.regions.id.vpcs.id.elbs.html

@@ -25,7 +25,7 @@ <h4>Listeners</h4>
             <ul>
                 {{#each listeners}}
                     <li class="list-group-item-text">
-                        {{@key}} ({{Protocol}}{{#if SslPolicy}}, {{SslPolicy}}{{/if}})
+                        <span id="elbv2.regions.{{../region}}.vpcs.{{../vpc}}.lbs.{{@../key}}.listeners.{{@key}}">{{@key}} ({{Protocol}}{{#if SslPolicy}}, {{SslPolicy}}{{/if}})</span>
                     </li>
                 {{/each}}
             </ul>

ScoutSuite/output/data/html/partials/gcp/services.computeengine.projects.id.global_forwarding_rules.html

@@ -0,0 +1,41 @@
+<!-- computeengine global_forwarding_rules -->
+<script id="services.computeengine.projects.id.global_forwarding_rules.partial" type="text/x-handlebars-template">
+    <div id="resource-name" class="list-group-item active">
+        <h4 class="list-group-item-heading">{{name}}</h4>
+    </div>
+    <div class="list-group-item">
+        <h4 class="list-group-item-heading">Information</h4>
+        <div class="list-group-item-text item-margin">ID: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.id"><samp>{{value_or_none id}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Name: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.name"><samp>{{value_or_none name}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Creation Timestamp: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.creation_timestamp"><samp>{{format_date creation_timestamp}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Description: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.description"><samp>{{value_or_none description}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Network: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.network"><samp>{{value_or_none network}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Subnetwork: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.subnetwork"><samp>{{value_or_none subnetwork}}</samp></span></div>
+        <div class="list-group-item-text item-margin">IP Address: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.ip_address"><samp>{{value_or_none ip_address}}</samp></span></div>
+        <div class="list-group-item-text item-margin">IP Protocol: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.ip_protocol"><samp>{{value_or_none ip_protocol}}</samp></span></div>
+        <div class="list-group-item-text item-margin">IP Version: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.ip_version"><samp>{{value_or_none ipVersion}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Allow Global Access: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.allow_global_access"><samp>{{value_or_none allowGlobalAccess}}</samp></span></div>
+        <div class="list-group-item-text item-margin">All Ports: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.all_ports"><samp>{{value_or_none allPorts}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Port Range: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.port_range"><samp>{{value_or_none port_range}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Ports: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.ports"><samp>{{value_or_none ports}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Target: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.target"><samp>{{value_or_none target}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Load Balancing Scheme: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.load_balancing_scheme"><samp>{{value_or_none load_balancing_scheme}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Network Tier: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.network_tier"><samp>{{value_or_none network_tier}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Backend Service: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.backend_service"><samp>{{value_or_none backendService}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Service Name: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.service_name"><samp>{{value_or_none serviceName}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Service Label: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.service_label"><samp>{{value_or_none serviceLabel}}</samp></span></div>
+        <div class="list-group-item-text item-margin">Labels: <span id="computeengine.projects.{{project}}.global_forwarding_rules.{{@key}}.labels"><samp>{{value_or_none labels}}</samp></span></div>
+    </div>
+</script>
+
+<script>
+    Handlebars.registerPartial("services.computeengine.projects.id.global_forwarding_rules", $("#services\\.computeengine\\.projects\\.id\\.global_forwarding_rules\\.partial").html());
+</script>
+
+<!-- Single computeengine global_forwarding_rule template -->
+<script id="single_computeengine_global_forwarding_rule-template" type="text/x-handlebars-template">
+    {{> modal-template template='services.computeengine.projects.id.global_forwarding_rules'}}
+</script>
+<script>
+    var single_computeengine_global_forwarding_rule_template = Handlebars.compile($("#single_computeengine_global_forwarding_rule-template").html());
+</script>