Nmap
Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
To learn more about the Nmap scanner itself visit [nmap.org].
Deployment
The Nmap ScanType can be deployed via helm:
helm upgrade --install nmap secureCodeBox/nmap
Scanner Configuration
The nmap scan target is set via the targets location of the securityTest. The target should be a Hostname or an IP Address.
Additional nmap scan features can be configured via the parameter attribute. For a detailed explanation to which parameters are available refer to the Nmap Reference Guide. All parameters are supported, but be careful with parameters that require root level rights, as these require additional configuration on the ScanType to be supported.
Some useful example parameters listed below:
-pxx: Scan ports of the target. Replace xx with a single port number or a range of ports.-PS,-PA,-PUxx: Replace xx with the ports to scan. TCP SYN/ACK or UDP discovery.-sV: Determine service and version info.-O: Determine OS info. Note: This requires the the user to be run as root or the system capabilities to be extended to allow nmap to send raw sockets. See more information on how to deploy the secureCodeBox nmap container to allow this and the nmap docs about priviliged scans-A: Determine service/version and OS info.-scriptxx: Replace xx with the script name. Start the scan with the given script.--scriptxx: Replace xx with a coma-separated list of scripts. Start the scan with the given scripts.
Operating System Scans
caution
Warning! This is currently not tested and might require additional testing to work 😕
If you want to use Nmap to identify operating systems of hosts you'll need to weaken the securityContext config, as Nmap requires the capability to send raw sockets to identify operating systems. See Nmap Docs
You can deploy the ScanType with the config like this:
cat <<EOF | helm install nmap-privileged ./scanners/nmap --values -
scannerJob:
env:
- name: "NMAP_PRIVILEGED"
value: "true"
securityContext:
capabilities:
drop:
- all
add:
- CAP_NET_RAW
- CAP_NET_ADMIN
- CAP_NET_BIND_SERVICE
EOF
You the start scans with operating system identification enabled:
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "nmap-os-scan"
spec:
scanType: "nmap-privileged"
parameters:
- --privileged
- "-O"
- www.iteratec.de
Chart Configuration
| Key | Type | Default | Description |
|---|---|---|---|
| image.repository | string | "docker.io/securecodebox/scanner-nmap" | Container Image to run the scan |
| image.tag | string | nil | defaults to the charts version |
| parseJob.ttlSecondsAfterFinished | string | nil | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
| parserImage.repository | string | "docker.io/securecodebox/parser-nmap" | Parser image repository |
| parserImage.tag | string | defaults to the charts appVersion | Parser image tag |
| scannerJob.backoffLimit | int | 3 | There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see: https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy) |
| scannerJob.env | list | [] | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
| scannerJob.extraContainers | list | [] | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) |
| scannerJob.extraVolumeMounts | list | [] | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
| scannerJob.extraVolumes | list | [] | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
| scannerJob.resources | object | {} | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
| scannerJob.securityContext | object | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true} | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
| scannerJob.securityContext.allowPrivilegeEscalation | bool | false | Ensure that users privileges cannot be escalated |
| scannerJob.securityContext.capabilities.drop[0] | string | "all" | This drops all linux privileges from the container. |
| scannerJob.securityContext.privileged | bool | false | Ensures that the scanner container is not run in privileged mode |
| scannerJob.securityContext.readOnlyRootFilesystem | bool | true | Prevents write access to the containers file system |
| scannerJob.securityContext.runAsNonRoot | bool | true | Enforces that the scanner image is run as a non root user |
| scannerJob.ttlSecondsAfterFinished | string | nil | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
Examples
demo-app-ssh
- Scan
- Findings
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "nmap-ssh-demo-cluster-internal"
spec:
scanType: "nmap"
parameters:
# Internal cluster is blocking our ping probes, therefore we skip them
- "-Pn"
# Service Detection enabled
- "-sV"
# Actual Service Address will depend on you cluster and namespace configuration. 🤷
- "dummy-ssh.demo-apps.svc"
demo-juice-shop
- Scan
- Findings
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "nmap-juice-shop-cluster-internal"
spec:
scanType: "nmap"
parameters:
# Internal cluster is blocking our ping probes, therefore we skip them
- "-Pn"
# Service Detection enabled
- "-sV"
# Actual Service Address will depend on you cluster and namespace configuration. 🤷
- juice-shop.demo-apps.svc.cluster.local
dummy-ssh-cascade
- Scan
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "nmap-dummy-ssh"
spec:
scanType: "nmap"
parameters:
# Internal cluster is blocking our ping probes, therefore we skip them
- "-Pn"
# Service Detection enabled
- "-sV"
# Actual Service Address will depend on you cluster and namespace configuration. 🤷
- "dummy-ssh.demo-apps.svc"
cascades:
matchLabels:
securecodebox.io/invasive: invasive
securecodebox.io/intensive: high
local-network
- Scan
- Findings
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "nmap-local-network"
spec:
scanType: "nmap"
parameters:
# Actual IP will depend on you network config. 🤷
- 192.168.178.0/24
localhost
- Scan
- Findings
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "nmap-localhost"
spec:
scanType: "nmap"
parameters:
# Note: Localhost here isn't "your" localhost, but the scanner container.
# This container doesn't have any ports open...
- localhost
scan.nmap.org
- Scan
- Findings
apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "nmap-scanme.nmap.org"
spec:
scanType: "nmap"
parameters:
- scanme.nmap.org