← 输入框|github.com|刷新
Skip to content

🚧 [Consistency] hostname vs. host vs. name vs. location in finding format  #853

Closed

Description

@malexmave

Some of our network-based scanners return the hostname of the target machine in the host attribute, some use name, and some use the hostname attribute. This discrepancy causes issues in the cascading scan scope definitions (a workaround was implemented in #805, but it would be nicer to avoid having to use it) and apparently also in building a Grafana dashboard, according to reports of a user on Slack.

I am not sure if we can fix this, since changing the findings format is a breaking change, but I wanted to at least have a central place where we can track how bad the issue is and which scanners are using which format.

A first rough survey shows the following for the different scanners:

Scanner location attributes.name attributes.hostname attributes.host Other
Amass ✅ ⚠️ name
Angularjs CSTI Scanner attributes.url (incl. template)
CMSeek ✅
Git Repo Scanner
Gitleaks
Kube Hunter ✅ (IP)
Kubeaudit ✅ (IP)
Ncrack ✅ (IP+port) attributes.ip_address
Nikto ✅ (URL of finding) ✅ (hostname of server)
Nmap ✅ (IP+port) ✅ (hostname)
Nuclei ✅ attributes.matched (incl. port)
Screenshooter ✅
Semgrep
SSH-scan ✅ ✅ (always null in unit tests)
SSLyze ✅ (+port) ✅
Trivy ✅ (scan target)
Typo3Scan ✅ (+port)
WhatWeb ✅ name
WPScan ✅ ✅
ZAP Advanced ✅ ✅
ZAP ✅ ✅

This is a first attempt at building this table and may still be slightly incorrect, especially since it is based on looking at unit tests for the parser module, not the parser itself. I also did not consider static analysis scanners like git repo scanner, gitleaks or semgrep.

Observations:

  • attributes.name and attributes.host are rarely used and could be set to attributes.hostname
  • I am not sure if location is being used consistently - in some cases it seems to denote the scanned server, in some it includes the exact URL of the match, in others the exact URL of the match is in a separate entry. Sometimes it contains the port, sometimes it doesn't.
  • Some scanners seem to have the exact same information in more than one key.

Related to #519.

Activity

  1. moved this to Todo in secureCodeBoxon Dec 7, 2021
  2. rfelber commented on Jul 25, 2022

    @rfelber
    Member

    V4 first step: remove host and replace with hostname

  3. self-assigned this
    on Sep 20, 2022
  4. moved this from Todo to In Progress in secureCodeBoxon Sep 20, 2022
  5. removed their assignment
    on Sep 20, 2022
  6. Ilyesbdlala commented on Nov 1, 2022

    @Ilyesbdlala
    Member

    V4 first step: remove host and replace with hostname

    Resolved in #1346.

  7. self-assigned this
    on Nov 15, 2022
  8. rfelber commented on Jan 25, 2023

    @rfelber
    Member

    Open Todo:

    • rename Amass attributes.name to attributes.hostname
  9. moved this from In Progress to Todo in secureCodeBoxon Jan 25, 2023
  10. added this to the v4.0.0 milestone on Jan 25, 2023
  11. Ilyesbdlala commented on Feb 20, 2023

    @Ilyesbdlala
    Member

    Open Todo:

    * [ ]  rename Amass `attributes.name` to `attributes.hostname`
    

    Done in #1605

  12. moved this from Todo to In Progress in secureCodeBoxon Feb 22, 2023
  13. rfelber commented on Mar 21, 2023

    @rfelber
    Member

    Fixed

  14. moved this from In Progress to Done in secureCodeBoxon Mar 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions