mirror of
https://github.com/j3ssie/osmedeus.git
synced 2026-08-22 15:42:27 +02:00
131 lines
4.2 KiB
YAML
131 lines
4.2 KiB
YAML
name: vulnerability-flow
|
|
kind: flow
|
|
desc: Vulnerability assessment flow with discovery, scanning, and reporting modules
|
|
|
|
params:
|
|
- name: threads
|
|
value: "25"
|
|
- name: severity
|
|
value: "medium,high,critical"
|
|
- name: templates
|
|
value: "{{Data}}/nuclei-templates"
|
|
|
|
modules:
|
|
# Module 1: Discovery - Find attack surface
|
|
- name: discovery
|
|
condition: "true"
|
|
steps:
|
|
- name: init-discovery
|
|
type: bash
|
|
commands:
|
|
- mkdir -p {{Output}}/discovery
|
|
- mkdir -p {{Output}}/endpoints
|
|
exports:
|
|
discovery_dir: "{{Output}}/discovery"
|
|
endpoints_dir: "{{Output}}/endpoints"
|
|
|
|
- name: find-endpoints
|
|
type: bash
|
|
parallel_commands:
|
|
- "{{Binaries}}/waybackurls {{Target}} > {{endpoints_dir}}/wayback.txt"
|
|
- "{{Binaries}}/gau {{Target}} > {{endpoints_dir}}/gau.txt"
|
|
- "{{Binaries}}/katana -u {{Target}} -silent -o {{endpoints_dir}}/katana.txt"
|
|
timeout: 900
|
|
on_error: continue
|
|
|
|
- name: merge-endpoints
|
|
type: bash
|
|
command: |
|
|
cat {{endpoints_dir}}/*.txt | sort -u > {{discovery_dir}}/all-endpoints.txt
|
|
grep -E '\.(php|asp|aspx|jsp|cgi)' {{discovery_dir}}/all-endpoints.txt > {{discovery_dir}}/dynamic-endpoints.txt || true
|
|
exports:
|
|
all_endpoints: "{{discovery_dir}}/all-endpoints.txt"
|
|
dynamic_endpoints: "{{discovery_dir}}/dynamic-endpoints.txt"
|
|
|
|
# Module 2: Scanning - Run vulnerability scanners
|
|
- name: scanning
|
|
depends_on:
|
|
- discovery
|
|
condition: "fileLength('{{all_endpoints}}') > 0"
|
|
steps:
|
|
- name: init-scanning
|
|
type: bash
|
|
commands:
|
|
- mkdir -p {{Output}}/vulns
|
|
- mkdir -p {{Output}}/findings
|
|
exports:
|
|
vulns_dir: "{{Output}}/vulns"
|
|
findings_dir: "{{Output}}/findings"
|
|
|
|
- name: nuclei-scan
|
|
type: bash
|
|
command: "{{Binaries}}/nuclei -l {{all_endpoints}} -t {{templates}} -severity {{severity}} -c {{threads}} -o {{vulns_dir}}/nuclei.json -jsonl"
|
|
timeout: 7200
|
|
on_error: continue
|
|
exports:
|
|
nuclei_results: "{{vulns_dir}}/nuclei.json"
|
|
|
|
- name: additional-scans
|
|
type: parallel-steps
|
|
parallel_steps:
|
|
- name: xss-scan
|
|
type: bash
|
|
command: "cat {{dynamic_endpoints}} | {{Binaries}}/dalfox pipe -o {{vulns_dir}}/xss.txt"
|
|
timeout: 3600
|
|
on_error: continue
|
|
- name: sqli-check
|
|
type: bash
|
|
command: "{{Binaries}}/sqlmap -m {{dynamic_endpoints}} --batch --output-dir={{vulns_dir}}/sqli"
|
|
timeout: 3600
|
|
on_error: continue
|
|
|
|
# Module 3: Reporting - Generate vulnerability reports
|
|
- name: reporting
|
|
depends_on:
|
|
- scanning
|
|
condition: "true"
|
|
steps:
|
|
- name: init-reports
|
|
type: bash
|
|
command: mkdir -p {{Output}}/reports
|
|
|
|
- name: aggregate-findings
|
|
type: function
|
|
script: |
|
|
var findings = [];
|
|
var nucleiFile = "{{nuclei_results}}";
|
|
|
|
if (fileExists(nucleiFile)) {
|
|
var content = readFile(nucleiFile);
|
|
var lines = content.split("\n").filter(function(l) { return l.trim().length > 0; });
|
|
findings = lines.map(function(l) {
|
|
try { return JSON.parse(l); } catch(e) { return {raw: l}; }
|
|
});
|
|
}
|
|
|
|
log_info("Total findings aggregated: " + findings.length);
|
|
writeFile("{{Output}}/reports/findings.json", JSON.stringify(findings, null, 2));
|
|
return findings.length;
|
|
exports:
|
|
finding_count: "{{Result}}"
|
|
|
|
- name: generate-report
|
|
type: bash
|
|
command: |
|
|
cat > {{Output}}/reports/vulnerability-report.md << EOF
|
|
# Vulnerability Assessment Report
|
|
|
|
**Target:** {{Target}}
|
|
**Date:** $(date)
|
|
**Severity Filter:** {{severity}}
|
|
|
|
## Summary
|
|
- Total Findings: {{finding_count}}
|
|
- Endpoints Scanned: $(wc -l < {{all_endpoints}})
|
|
|
|
## Detailed Findings
|
|
See findings.json for complete details.
|
|
EOF
|
|
exports:
|
|
final_report: "{{Output}}/reports/vulnerability-report.md"
|