J12934 · Aug 27, 2021 · Aug 19, 2021 · Aug 19, 2021 · Aug 19, 2021 · Aug 19, 2021
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -487,6 +487,7 @@ jobs:
           - sslyze
           - test-scan
           - trivy
+          - typo3scan
           - wpscan
           - zap
 

diff --git a/scanners/typo3scan/.helm-docs.gotmpl b/scanners/typo3scan/.helm-docs.gotmpl
@@ -0,0 +1,50 @@
+{{- /*
+SPDX-FileCopyrightText: 2021 iteratec GmbH
+
+SPDX-License-Identifier: Apache-2.0
+*/ -}}
+
+{{- define "extra.docsSection" -}}
+---
+title: "Typo3Scan"
+category: "scanner"
+type: "Network"
+state: "released"
+appVersion: "{{ template "chart.appVersion" . }}"
+usecase: "Automation of the process of detecting the Typo3 CMS and its installed extensions"
+---
+{{- end }}
+
+{{- define "extra.dockerDeploymentSection" -}}
+## Supported Tags
+- `latest`  (represents the latest stable release build)
+- tagged releases, e.g. `{{ template "chart.appVersion" . }}`
+{{- end }}
+
+{{- define "extra.chartAboutSection" -}}
+## What is Typo3Scan?
+Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions.
+
+To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan].
+{{- end }}
+
+{{- define "extra.scannerConfigurationSection" -}}
+## Scanner Configuration
+
+The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range.
+
+Additional Typo3Scan scan features can be configured via the parameter attribute.
+
+Some useful example parameters listed below:
+
+- `--vuln` : Check for extensions with known vulnerabilities only.
+- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds
+- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization.
+- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies.
+- `--agent USER-AGENT`: Set custom User-Agent for requests.
+- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5
+- `--json`: Output results to json file
+- `--force`: Force enumeration
+- `--no-interaction`: Do not ask any interactive question
+
+{{- end }}
diff --git a/scanners/typo3scan/.helmignore b/scanners/typo3scan/.helmignore
@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/scanners/typo3scan/Chart.yaml b/scanners/typo3scan/Chart.yaml
@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+apiVersion: v2
+name: typo3scan
+description: A Helm chart for the Typo3 security scanner that integrates with the secureCodeBox
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
+version: v3.1.0-alpha1
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "0.7.2"
+kubeVersion: ">=v1.11.0-0"
+keywords:  
+  - security
+  - typo3scan
+  - typo3
+  - scanner
+  - secureCodeBox
+
+home: https://docs.securecodebox.io/docs/scanners/typo3scan
+icon: https://docs.securecodebox.io/img/integrationIcons/Default.svg
+
+sources:
+  - https://github.com/secureCodeBox/secureCodeBox
+
+maintainers:
+  - name: iteratec GmbH
+  - email: secureCodeBox@iteratec.com  
diff --git a/scanners/typo3scan/README.md b/scanners/typo3scan/README.md
@@ -0,0 +1,70 @@
+---
+title: "Typo3Scan"
+category: "scanner"
+type: "Network"
+state: "released"
+appVersion: "0.7.2"
+usecase: "Automation of the process of detecting the Typo3 CMS and its installed extensions"
+---
+
+<!--
+SPDX-FileCopyrightText: 2021 iteratec GmbH
+
+SPDX-License-Identifier: Apache-2.0
+-->
+<!--
+.: IMPORTANT! :.
+--------------------------
+This file is generated automatically with `helm-docs` based on the following template files:
+- ./.helm-docs/templates.gotmpl (general template data for all charts)
+- ./chart-folder/.helm-docs.gotmpl (chart specific template data)
+
+Please be aware of that and apply your changes only within those template files instead of this file.
+Otherwise your changes will be reverted/overwritten automatically due to the build process `./.github/workflows/helm-docs.yaml`
+--------------------------
+-->
+
+<p align="center">
+  <a href="https://opensource.org/licenses/Apache-2.0"><img alt="License Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/releases/latest"><img alt="GitHub release (latest SemVer)" src="https://img.shields.io/github/v/release/secureCodeBox/secureCodeBox?sort=semver"/></a>
+  <a href="https://owasp.org/www-project-securecodebox/"><img alt="OWASP Incubator Project" src="https://img.shields.io/badge/OWASP-Incubator%20Project-365EAA"/></a>
+  <a href="https://artifacthub.io/packages/search?repo=securecodebox"><img alt="Artifact HUB" src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/securecodebox"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/"><img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/secureCodeBox/secureCodeBox?logo=GitHub"/></a>
+  <a href="https://twitter.com/securecodebox"><img alt="Twitter Follower" src="https://img.shields.io/twitter/follow/securecodebox?style=flat&color=blue&logo=twitter"/></a>
+</p>
+
+## What is Typo3Scan?
+Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions.
+
+To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan].
+
+## Deployment
+The typo3scan chart can be deployed via helm:
+
+```bash
+# Install HelmChart (use -n to configure another namespace)
+helm upgrade --install typo3scan secureCodeBox/typo3scan
+```
+
+## Scanner Configuration
+
+The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range.
+
+Additional Typo3Scan scan features can be configured via the parameter attribute.
+
+Some useful example parameters listed below:
+
+- `--vuln` : Check for extensions with known vulnerabilities only.
+- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds
+- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization.
+- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies.
+- `--agent USER-AGENT`: Set custom User-Agent for requests.
+- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5
+- `--json`: Output results to json file
+- `--force`: Force enumeration
+- `--no-interaction`: Do not ask any interactive question
+
+## Requirements
+
+Kubernetes: `>=v1.11.0-0`
+
diff --git a/scanners/typo3scan/docs/.gitkeep b/scanners/typo3scan/docs/.gitkeep
diff --git a/scanners/typo3scan/docs/README.ArtifactHub.md b/scanners/typo3scan/docs/README.ArtifactHub.md
@@ -0,0 +1,77 @@
+<!--
+SPDX-FileCopyrightText: 2021 iteratec GmbH
+
+SPDX-License-Identifier: Apache-2.0
+-->
+<!--
+.: IMPORTANT! :.
+--------------------------
+This file is generated automatically with `helm-docs` based on the following template files:
+- ./.helm-docs/templates.gotmpl (general template data for all charts)
+- ./chart-folder/.helm-docs.gotmpl (chart specific template data)
+
+Please be aware of that and apply your changes only within those template files instead of this file.
+Otherwise your changes will be reverted/overwritten automatically due to the build process `./.github/workflows/helm-docs.yaml`
+--------------------------
+-->
+
+<p align="center">
+  <a href="https://opensource.org/licenses/Apache-2.0"><img alt="License Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/releases/latest"><img alt="GitHub release (latest SemVer)" src="https://img.shields.io/github/v/release/secureCodeBox/secureCodeBox?sort=semver"/></a>
+  <a href="https://owasp.org/www-project-securecodebox/"><img alt="OWASP Incubator Project" src="https://img.shields.io/badge/OWASP-Incubator%20Project-365EAA"/></a>
+  <a href="https://artifacthub.io/packages/search?repo=securecodebox"><img alt="Artifact HUB" src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/securecodebox"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/"><img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/secureCodeBox/secureCodeBox?logo=GitHub"/></a>
+  <a href="https://twitter.com/securecodebox"><img alt="Twitter Follower" src="https://img.shields.io/twitter/follow/securecodebox?style=flat&color=blue&logo=twitter"/></a>
+</p>
+
+## What is OWASP secureCodeBox?
+
+<p align="center">
+  <img alt="secureCodeBox Logo" src="https://docs.securecodebox.io/img/Logo_Color.svg" width="250px"/>
+</p>
+
+_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios.
+
+With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues.
+
+The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure.
+
+### Quickstart with secureCodeBox on kubernetes
+
+You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it.
+
+## What is Typo3Scan?
+Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions.
+
+To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan].
+
+## Deployment
+The typo3scan chart can be deployed via helm:
+
+```bash
+# Install HelmChart (use -n to configure another namespace)
+helm upgrade --install typo3scan secureCodeBox/typo3scan
+```
+
+## Scanner Configuration
+
+The Typo3Scan targets are specified with the `-d` parameter. The target should be a hostname, an IP address or an IP range.
+
+Additional Typo3Scan scan features can be configured via the parameter attribute.
+
+Some useful example parameters listed below:
+
+- `--vuln` : Check for extensions with known vulnerabilities only.
+- `--timeout TIMEOUT` : Request Timeout. Default: 10 seconds
+- `--auth USER:PASS`: Username and Password for HTTP Basic Authorization.
+- `--cookie NAME=VALUE`: Can be used for authenticiation based on cookies.
+- `--agent USER-AGENT`: Set custom User-Agent for requests.
+- `--threads THREADS`: The number of threads to use for enumerating extensions. Default: 5
+- `--json`: Output results to json file
+- `--force`: Force enumeration
+- `--no-interaction`: Do not ask any interactive question
+
+## Requirements
+
+Kubernetes: `>=v1.11.0-0`
+
diff --git a/scanners/typo3scan/docs/README.DockerHub-Parser.md b/scanners/typo3scan/docs/README.DockerHub-Parser.md
@@ -0,0 +1,82 @@
+<!--
+SPDX-FileCopyrightText: 2021 iteratec GmbH
+
+SPDX-License-Identifier: Apache-2.0
+-->
+<!--
+.: IMPORTANT! :.
+--------------------------
+This file is generated automatically with `helm-docs` based on the following template files:
+- ./.helm-docs/templates.gotmpl (general template data for all charts)
+- ./chart-folder/.helm-docs.gotmpl (chart specific template data)
+
+Please be aware of that and apply your changes only within those template files instead of this file.
+Otherwise your changes will be reverted/overwritten automatically due to the build process `./.github/workflows/helm-docs.yaml`
+--------------------------
+-->
+
+<p align="center">
+  <a href="https://opensource.org/licenses/Apache-2.0"><img alt="License Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/releases/latest"><img alt="GitHub release (latest SemVer)" src="https://img.shields.io/github/v/release/secureCodeBox/secureCodeBox?sort=semver"/></a>
+  <a href="https://owasp.org/www-project-securecodebox/"><img alt="OWASP Incubator Project" src="https://img.shields.io/badge/OWASP-Incubator%20Project-365EAA"/></a>
+  <a href="https://artifacthub.io/packages/search?repo=securecodebox"><img alt="Artifact HUB" src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/securecodebox"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/"><img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/secureCodeBox/secureCodeBox?logo=GitHub"/></a>
+  <a href="https://twitter.com/securecodebox"><img alt="Twitter Follower" src="https://img.shields.io/twitter/follow/securecodebox?style=flat&color=blue&logo=twitter"/></a>
+</p>
+
+## What is OWASP secureCodeBox?
+
+<p align="center">
+  <img alt="secureCodeBox Logo" src="https://docs.securecodebox.io/img/Logo_Color.svg" width="250px"/>
+</p>
+
+_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios.
+
+With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues.
+
+The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure.
+
+### Quickstart with secureCodeBox on kubernetes
+
+You can find resources to help you get started on our [documentation website](https://docs.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://docs.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://docs.securecodebox.io/docs/getting-started/first-scans) with it.
+
+## Supported Tags
+- `latest`  (represents the latest stable release build)
+- tagged releases, e.g. `0.7.2`
+
+## How to use this image
+This `parser` image is intended to work in combination with the corresponding security scanner docker image to parse the `findings` results. For more information details please take a look at the documentation page: https://docs.securecodebox.io/docs/scanners/typo3scan.
+
+```bash
+docker pull securecodebox/parser-typo3scan
+```
+
+## What is Typo3Scan?
+Typo3Scan is an open source penetration testing tool to automate the process of detecting the Typo3 CMS and it's installed extensions. It also has a database with known vulnerabilities for core and extensions.
+
+To learn more about the Typo3Scan scanner itself visit [https://github.com/whoot/Typo3Scan].
+
+## Community
+
+You are welcome, please join us on... 👋
+
+- [GitHub][scb-github]
+- [Slack][scb-slack]
+- [Twitter][scb-twitter]
+
+secureCodeBox is an official [OWASP][scb-owasp] project.
+
+## License
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+
+As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).
+
+As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.
+
+[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox
+[scb-docs]: https://docs.securecodebox.io/
+[scb-site]: https://www.securecodebox.io/
+[scb-github]: https://github.com/secureCodeBox/
+[scb-twitter]: https://twitter.com/secureCodeBox
+[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU
+[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE
-Original file line number
+Diff line change
@@ Expand Up / @@ -487,6 +487,7 @@ jobs: @@
               - sslyze
               - test-scan
               - trivy
+              - typo3scan
               - wpscan
               - zap
@@ Expand Down @@