e7240b2a51
The core engine's dependency on the callback server repository is now configurable through environment variables.
...
PiperOrigin-RevId: 802576391
Change-Id: I5bc416d5c8b4b814c608a577584d648d91a12845
2025-09-03 09:02:17 -07:00
25d5f75d22
Align all Tsunami dependencies to the same version.
...
PiperOrigin-RevId: 795544271
Change-Id: I4bef53e7e64ee969ca32dd4294c54c6c9020031b
2025-08-15 11:23:08 -07:00
fab404a89e
Stop depending on the Maven release of the callback server. Directly use the stable branch of GitHub.
...
PiperOrigin-RevId: 783230685
Change-Id: I48f05bc1fbe612b0e899be459f4388beda07e003
2025-07-15 01:34:03 -07:00
3aa29cbf9c
Inline and reorganize dependencies in the core engine.
...
This might sound counter-intuitive, but expanding dependencies makes it easier to manage at scale with tools such as grep/sed/awk.
PiperOrigin-RevId: 782949734
Change-Id: I923258ed15870c846e28c59fd35f801208a98aae
2025-07-14 10:12:40 -07:00
55256fe724
Add a workflow where Tsunami simply dumps the list of currently registered advisories to a textproto file.
...
PiperOrigin-RevId: 775111111
Change-Id: I4b37b35fb7e8e330c81f0d47164f81cfd2be8580
2025-06-24 00:56:17 -07:00
7ab538db0a
Associate advisories to fake detectors to be able to use them in tests.
...
PiperOrigin-RevId: 774783760
Change-Id: Ie2e678afd09b5fd000f38b5508650d54ecce8054
2025-06-23 08:10:52 -07:00
09b0146a69
Extend the Detector API with a `getAdvisories()` method that returns all advisories used by a detector.
...
PiperOrigin-RevId: 770967059
Change-Id: I19bf8b593c0ec5854e4de25d821b55c0d641c53c
2025-06-13 00:15:23 -07:00
d7270203d0
[ ee15895]( ee15895788) completely broke our artifacts published to Maven. This should be fixed.
...
PiperOrigin-RevId: 767231768
Change-Id: Icca176cb1494d53ce6f752b9e54afc83e9aaf4f0
2025-06-04 11:52:23 -07:00
3060090ef3
Update gradle files of Tsunami core engine to support gradle 8.14.
...
PiperOrigin-RevId: 760519812
Change-Id: Ic46431d190b0dfc3b68bdd96768679e6132ceb4c
2025-05-19 01:46:43 -07:00
9a3af379f6
Tsunami now reports whether the host is alive or down during scanning.
...
Note that the heuristic is simply based on the number of vulnerabilities and identified services.
Because the `-Pn` (consider all host alive) is passed down to nmap, this is the best option.
PiperOrigin-RevId: 734509566
Change-Id: Ic56a89f6e6766a5adfc640b0a8950446d3502478
2025-03-07 04:47:25 -08:00
eff2b921fb
New command line flags `--detectors-include` and `--detectors-exclude` to fine tune which scanners to execute during the scan.
...
PiperOrigin-RevId: 722986341
Change-Id: I89234e177db000ba6763717132c01fbb37cc84da
2025-02-04 01:50:22 -08:00
694bbda423
Change the error output of the callback server client.
...
PiperOrigin-RevId: 717495992
Change-Id: Ic048cdcf16413dd2f94a2ead6afc441d17087e1d
2025-01-20 05:06:42 -08:00
6f0a8dc3ed
Copybara import of the project:
...
--
ce33b3113a4b6b849cb5https://github.com/google/tsunami-security-scanner/pull/127 from mindedsecurity:master 4b6b849cb5
2024-12-11 14:42:44 -08:00
362c3fbc32
Provide getters for the callback address and port in the Tsunami callback client.
...
PiperOrigin-RevId: 702120836
Change-Id: I7efa6684b5cca5f734ee2aac8cb99717a6a82161
2024-12-02 16:32:51 -08:00
02eb2ad133
Extend Tsunami's core engine to support dynamic plugins.
...
A dynamic plugin is a plugin that is entirely created at runtime.
PiperOrigin-RevId: 701269359
Change-Id: I10adafb30dfbee80da5d81eb374c94e745438179
2024-11-29 06:04:03 -08:00
6efeffab72
Bugfix: Fixes DEADLINE_EXCEEDED errors when the nmap scan takes too long.
...
Given communication with the remote plugin server may be delayed (depending on how long the nmap scan takes), we should not rely on a static Deadline class here, as it represents an absolute point in time.
PiperOrigin-RevId: 675475722
Change-Id: Id335381dfea7db0a52e458452c6530d6cc0f7f28
2024-09-17 02:08:48 -07:00
5697a75fbd
Do not wait 1 minute on daemon thread on exit. Force explicit exit at the end of the main.
...
There should be no reason for the JVM to wait on daemon thread once Tsunami exits.
This will:
- Make `ctrl+c` immediate rather than 1 minute delayed;
- Reduce waiting time once Tsunami reports that it finished;
PiperOrigin-RevId: 670175123
Change-Id: I44f8998a715c7344a885fbbe674ca326714e2c8f
2024-09-02 04:50:48 -07:00
d741561c90
Introduce the `RequiresCallbackServer` annotation that ensures a plugin only gets executed if the callback server is present.
...
PiperOrigin-RevId: 667556868
Change-Id: I8641612e85372a89812e2173705da999e640c35e
2024-08-26 05:59:04 -07:00
a184c09eb1
Log the execution time of each plugin. This allows for identification and optimization of plugins taking the longest time.
...
PiperOrigin-RevId: 666334401
Change-Id: I7c922ed89b1463cdf3268bd77ac37a55e5dd74eb
2024-08-22 07:04:36 -07:00
2f2bd0baef
Merge pull request #110 from doyensec:additional_rce_payloads
...
PiperOrigin-RevId: 662944088
Change-Id: I3910182770bc14410b54513b254bb02699c4e92b
2024-08-14 09:18:06 -07:00
67f5d7958f
Support compact RunRequest so requests sent to heavy plugin services still fit in the default gRPC message limit.
...
PiperOrigin-RevId: 656270995
Change-Id: I3216fe01796ff866caa464aad1d49d1c0dd35256
2024-07-25 23:51:29 -07:00
b4b20896a8
Support OS fingerprinting
...
PiperOrigin-RevId: 655093248
Change-Id: I89e1a894dac6eeaeb868fa14462310ed0fc63ee7
2024-07-23 02:57:09 -07:00
6c691938e3
Various language server improvements
...
- Refactor (redundant code removed)
- Parsing options via CliOptionsModule (instead of manually)
- Support for multiple remote language servers
- Support for customizing the RPC deadline for each plugin server (either local or remote)
PiperOrigin-RevId: 650904806
Change-Id: I8b2488d794712e30f55f8adfa4656cfdcff76259
2024-07-10 01:13:26 -07:00
41097b59f2
Add python server cli option to Tsunami main cli, fix setup script and upgrade guice and mokito versions.
...
PiperOrigin-RevId: 636573428
Change-Id: Ib105fb5459d6081bb9b45d569df989e9f1e36d36
2024-05-23 09:18:44 -07:00
96b5229b67
increase python server initialization time even more.
...
PiperOrigin-RevId: 611591984
Change-Id: Ib10c1e0b8afc9807fe8523545fee7f3c26e89255
2024-02-29 14:13:40 -08:00
0e199bace2
Increase retry delay attempts to shake off flakey connection.
...
PiperOrigin-RevId: 609499695
Change-Id: I59750a9c9633eea9b1ebe2941b4717cedcaf615f
2024-02-22 14:29:39 -08:00
cac9e76325
Migrate usages of `Truth8.assertThat` to equivalent usages of `Truth.assertThat`.
...
The `Truth8` methods have been deprecated. Callers should move to `Truth`.
**If your project is also built outside the monorepo:** Some (but not all) of the CLs in this batch require Truth [1.4.0](https://github.com/google/truth/releases/tag/v1.4.0 ). If I see a presubmit failure, I'll look for a place to upgrade the version. Or you can point me there ahead of time.
PiperOrigin-RevId: 606267767
Change-Id: Ic1e37e2172e45f86efaaa23eeba6859a85a4c9bb
2024-02-12 09:00:44 -08:00
84f2f50b06
Implement retries for listPlugins request to allow language servers to ramp up.
...
PiperOrigin-RevId: 605588300
Change-Id: I8fc52f758d13f53d225f185085af34375b888e73
2024-02-09 04:03:25 -08:00
d2cd06818f
No public description
...
PiperOrigin-RevId: 603092504
Change-Id: I9bc1013f8511dcaa0b54666ae75e3df14f4259c6
2024-01-31 10:33:33 -08:00
4324996c25
Configure output dir config for language server
...
PiperOrigin-RevId: 600931739
Change-Id: I37884eca12d6f375aa25beddd3f0b38d06f1c77c
2024-01-23 15:52:56 -08:00
186512915c
Additional RCE payloads
2024-01-22 12:28:02 +01:00
4d6e983f2f
Add debugging log to language server interactions.
...
PiperOrigin-RevId: 599918810
Change-Id: I10be436b01a708ad6e1dba27fb5234f07eb1f241
2024-01-19 13:14:22 -08:00
65e84d562a
Break up callback uri for linux payload by adding a empty val.
...
PiperOrigin-RevId: 569296906
Change-Id: I21db9d019c16c3be9853385d397ed51895849862
2023-09-28 14:49:21 -07:00
93dee009eb
Break up callback uri for linux payload by adding a empty val.
...
PiperOrigin-RevId: 564763573
Change-Id: I74929a10555589ad2611ff7587d69697e525597d
2023-09-12 10:31:36 -07:00
c1e80ba636
Handle empty config file and language server commands
...
PiperOrigin-RevId: 544706361
Change-Id: Ic035fa23754cac167d73b8f2506f76181908b48a
2023-06-30 11:23:28 -07:00
9ff2db18e3
Handle empty config file and language server commands
...
PiperOrigin-RevId: 543986290
Change-Id: I21bf63ddff9b895f32533c7652cc627ed9a1d68e
2023-06-28 01:41:36 -07:00
903c53f4c8
Handle empty config file and language server commands
...
PiperOrigin-RevId: 543799505
Change-Id: Ic2451914b105622fa5d1f2320a7027b0ea54a947
2023-06-27 11:14:11 -07:00
a70f17d036
Add 1-hour throttling to each plugin.
...
PiperOrigin-RevId: 538910452
Change-Id: Id4579e6ad20e309a7da49a4ac03002a5189ead4a
2023-06-08 15:43:12 -07:00
cd820e78c6
Pass in configurations for HTTP client and callback server to the python plugin server via commands.
...
PiperOrigin-RevId: 532622401
Change-Id: I20f98d3a3c23d4ffc6d77d10ef3f28228fd8eb4f
2023-05-16 17:32:01 -07:00
8757ec6506
Internal change
...
PiperOrigin-RevId: 522139601
Change-Id: Iaaac9dc15d588858c516cf30094bced2014d6601
2023-04-05 13:31:51 -07:00
50ee659074
Allow callback server configs to be passed in as cli options in Tsunami.
...
PiperOrigin-RevId: 508696557
Change-Id: Iaa3c071a54ae0883ef7cfc8dd993ced0608fcbd8
2023-02-10 10:35:07 -08:00
f217863d23
Change SSRF target for non-callback case to a non google.com url to avoid false positives when a domain is not configured and results in the Google 404 page.
...
PiperOrigin-RevId: 492222553
Change-Id: I2e1c0b84cf10ef3e27949c278e9f76946241c9f5
2022-12-01 09:49:48 -08:00
67bb43e549
Connect java Tsunami workflow with python grpc server and update gRPC deadline time on the Java client side.
...
PiperOrigin-RevId: 466781143
Change-Id: I7da50e3c0fab2704dab956fa7bdc725e288e7a2e
2022-08-10 14:08:04 -07:00
8a56c33d63
Add tests for RemoteVulnDetector helper methods for matching remote plugins with services.
...
PiperOrigin-RevId: 464607972
Change-Id: I89f7bd4eb19ecaa07bb3e0a7c7897dbfb480d95d
2022-08-01 13:21:38 -07:00
1888fb5a31
Add helper methods for matching remote plugins with the targets.
...
PiperOrigin-RevId: 464588286
Change-Id: Id420924a591ffccbb4ddfaaf0f9f8029486ba819
2022-08-01 11:57:52 -07:00
816ec61f8f
Running tsunami with callback server to verify producing both types of payloads with callback server enabled.
...
PiperOrigin-RevId: 464001136
Change-Id: If39d2fe4bf15296910b2cf6cb36bed17982c4118
2022-07-28 22:20:24 -07:00
897f396ae3
Add failed RemoteVulnDetectors for testing purposes.
...
PiperOrigin-RevId: 461691002
Change-Id: I1546bac52756a31669e5c6e20e87c04b2e22d65d
2022-07-18 12:53:10 -07:00
524d383a63
Add remote plugins to the plugin matching proccess in the PluginManager.
...
PiperOrigin-RevId: 461688117
Change-Id: I3d40b12d77bc431b8e60f7ad1060effd69525421
2022-07-18 12:41:51 -07:00
ed40cfcaa6
Add RemoteVulnDetectorLoadingModule to load plugins from language servers.
...
PiperOrigin-RevId: 461661699
Change-Id: I9c3d4490db2e4123bff8eb3ec1f91e70dc4d6d70
2022-07-18 10:55:14 -07:00
09bd2a8b3e
Fix RemoteVulnDetectors unintentionally going through PluginBootstrapModule configure.
...
PiperOrigin-RevId: 461639793
Change-Id: Ib0087fff9b5c9a41433784db808c9773f9a7b7fc
2022-07-18 09:30:26 -07:00
Pierre Precourt
Tsunami Team
Leonardo Tamiano
Copybara-Service
Annie Mao
Nghi Tran
cpovirk
Dawid Golunski
Guoli Ma
Albert Cui
John Y. Kim
Shruti Gupta