Security scanner which probes the front door of your web applications.
I needed to scan some webapps at work using the usual suspects (nmap, ssllabs, securityheaders) and I figured a cmd line thingy to tie all those together would be pretty quick to write. Hope it's useful to you too.
Why is it called Etuovi?
Well I wanted to call this front-door but that npm package already exists. And given the limited imagination I have, I just used Google Translate until I found a translation of front door that sounded cool. Hence, Etuovi. Which Google reliably informs me is the Finnish for front door (if it's not, please tell me).
Table of Contents generated with DocToc
- Getting Started
- Configuring Scanners
- Configuring Outputs
- Actually Running a scan using Etuovi
Etuovi is designed to run as a global package:
$ npm install -g etuovi
Now you probably want to make a directory to hold your scan configuration and output reports.
$ mkdir etuovi-config && cd etuovi-config
Now create a starter configuration file which we'll need to edit later:
$ etuovi new-config
You'll get a config file with a name like this
etuovi-config-20170708-233728.json with contents like this:
In essence, you configure multiple hosts with multple scanners per host.
Note that the expect properties are not currently used. They will be the basis of alerting in the future.
This scanner is a convenience wrapper around nmap. Consequently, in order for this scanner to work, nmap must be on the path.
options property can be omitted and a default nmap port scan will be performed.
This scanner uses the Evilscan module and is provided for situations where installing nmap is not possible.
ports property can be omitted and a default the port scan will be performed for the top 1000 ports as per nmap.
This scanner will perform a scan for security headers using securityheaders.io. It supports multiple paths under the host to handle the scenario where you have multiple web apps under a host.
paths property can be omitted and a default of "/" will be used.
This scanner will check the SSL configuration using the Qualys SSL Labs API. Please go read the terms and conditions of the API usage.
By default, the scan will use a
maxAge of 23 hours and allow the results to come
fromCache. Tweak the values below to your liking, or
omit them if they suit. See here for more details. https://github.com/ssllabs/ssllabs-scan/blob/stable/ssllabs-api-docs.md
This scanner will inspect an array of paths, reporting on the http status codes it encounters. You can use this to check that redirects are working etc. It will also check for the presence of header values on the response. When checking for headers, the headers inspected are the amalgamation of the headers specified at the path level and the those specified at the root. I.e. the path and root headers are merged with the path headers overriding the root headers.
Deprecated, use the headers scanner above
This scanner will inspect an array of paths, reporting on the http status codes it encounters. You can use this to check that redirects are working etc.
By default, Etuovi writes to the console. However, there are other outputs available when scanning.
If you enable the
file output, the full detailed reports of the scans are written, by default, to the
reports directory of the current working directory. The file name will look something like
etuovi__scan__report__20170707__221954.json. To change the output directory, change the
reportsDir property in the
file output configuration.
Etuovi can post a message to slack containing the summaries of all the scans of all the hosts in your config file.
Actually Running a scan using Etuovi
$ etuovi scan etuovi-config-20170708-233728.json
The log output of Etuovi can be controlled via the
$ etuovi scan my-config.json --log-level=verbose