Security Scanner CLI Tool

A Command Line Interface (CLI) tool for scanning and analyzing mobile APK files, Docker images and code repository for security vulnerabilities using various security tools.

Table of Contents

• Features
• Prerequisites
• Installation
• Usage
  • Mobile Commands
  • Docker Commands
  • Code Commands
• Extending the Tool
  • Adding New Commands
  • Adding New Functions
  • Extending shell_escape_finder.py

Features

• Mobile App Analysis: Scan APK files using MobSF for comprehensive mobile app security assessment.

• Docker Image Scanning: Analyze Docker images for vulnerabilities using Trivy.

• Code Repository Analysis:

  • Use Bandit for Python code security checks.
  • Custom shell escape vulnerability detection for Python, JavaScript, and Bash files.

• Rich CLI Output: Enhanced readability with colored and formatted output using the Rich library.

• Jira Integration: Create Jira tickets based on scan results for streamlined workflow integration.

Prerequisites

• Python 3.12+
• Docker (for MobSF and Trivy functionality)
• Git (for repository scanning features)

Installation

:exclamation: Note: Make sure you have Docker installed and running.

Install from Source Code

1. Clone the repository:

   git clone https://github.com/briskdust/ingy-cli.git
   cd ingy-cli
   

2. Install the required Python packages:

   poetry install
   

3. Run the CLI tool:

   python -m ingysec.ingy
   

Install using Pip

1. Install the tool from PyPI:

   pip install ingysec
   

2. Run the CLI tool:

   ingysec
   

Usage

This CLI tool supports multiple commands grouped under mobile, docker, and code.

Mobile Commands

Scan and analyze APK files for security vulnerabilities using MobSF.

Initialization

This command will initialize the MobSF docker container and run it on port 8000. It will also provide the API key for the MobSF server.

ingysec mobile mobsf_init

Configuration

Set the MOBSF_APIKEY environment variable with your MobSF API key:

export MOBSF_APIKEY=your_mobsf_api_key

Scan APK Files

ingysec mobile mobsf --apikey YOUR_API_KEY --pdf output.pdf path/to/file1.apk path/to/file2.apk

• --apikey: API key for MobSF authentication. Or set the MOBSF_APIKEY environment variable.
• --pdf: Optional. If specified, generates a PDF report, otherwise the results will be displayed in terminal as a table.

Docker Commands

Run Trivy scan for a Docker image.

Installation

This command will install Trivy on your system. Only run it once, and it only works on Linux(Debian/Ubuntu) systems.

ingysec docker trivy_install

Scan Docker Images

ingysec docker trivy --name IMAGE_NAME --html template.html

• --name: Name or ID of the Docker image to scan.
• --html: Optional. Path to an HTML template file for generating the report. If not present, the results will be displayed in the terminal as a table.

Code Commands

Run code inspection and scanning commands to detect security vulnerabilities in Python code.

Bandit

Run Bandit to check Python code for security vulnerabilities.

ingysec code bandit

Prompts the user to enter the path to the Python code. Recursively scans all Python files in the specified path using the Bandit configuration file bandit.yaml. Sets the severity level to high (-ll) and reports all discovered security issues.

Shell Escape

Scan code for potential shell escape vulnerabilities.

ingysec code shell-escape REPONAME --seckey PATH

The user needs to enter the path to the repository which can also be the URL of a remote repository and utilize the --seckey flag to specify the path to the SSH private key for cloning the repository. Supports shell expansion, such as ~ to the full home directory path and verifies that the provided path is a directory.

Jira Commands

Create a new Jira ticket based on scan results or manual input:

ingysec ticket create_ticket \
  --server https://your-domain.atlassian.net \
  --email your-email@example.com \
  --api_token your-api-token \
  --project PROJ \
  --summary "Security Issue Found" \
  --description "Description of the security issue" \
  --issuetype Bug \
  --priority High \
  --assignee username

You can also set environment variables for Jira credentials:

export JIRA_SERVER=https://your-domain.atlassian.net
export JIRA_EMAIL=your-email@example.com
export JIRA_API_TOKEN=your-api-token

Then run the command without these options:

ingysec ticket create_ticket \
  --project PROJ \
  --summary "Security Issue Found" \
  --description "Description of the security issue" \
  --issuetype Bug \
  --priority High \
  --assignee username

The tool will prompt for any missing required information.

Extending the Tool

Adding New Commands

To implement a new command, create a new command group in ingysec/ingy.py:

@main.group()
def example_command():
    """This is an example command group."""
    pass

Then, add a new command to the group:

@example_command.command()
def new_command():
    """This is a new command."""
    pass

Adding New Functions

For the purpose of maintainability and clean code, add new functions to the utils.py file.

Extending shell_escape_finder.py

To extend the script to support more languages, you need to update two main components:

1. File Extensions: Add the file extensions of the new languages to the FILE_EXTENSIONS list.
2. Patterns: Add regex patterns to identify potential shell escape vulnerabilities in the PATTERNS dictionary.