osmedeus/test/testdata/complex-workflows/vulnerability-assessment.yaml

name: vulnerability-assessment
kind: module
desc: Vulnerability scanning with Docker runner and comprehensive error handling

runner: docker
runner_config:
  image: "osmedeus/scanner:latest"
  volumes:
    - "{{Output}}:/output"
    - "{{Data}}:/data"
  network: "host"

params:
  - name: threads
    value: "25"
  - name: severity
    value: "medium,high,critical"
  - name: templates_path
    value: "{{Data}}/nuclei-templates"

steps:
  # Step 1: bash - Setup scan environment
  - name: setup-environment
    type: bash
    commands:
      - mkdir -p {{Output}}/vulns
      - mkdir -p {{Output}}/findings
      - mkdir -p {{Output}}/raw
    exports:
      vulns_dir: "{{Output}}/vulns"
      findings_dir: "{{Output}}/findings"

  # Step 2: function - Validate inputs and log configuration
  - name: validate-config
    type: function
    script: |
      log_info("Vulnerability Assessment Configuration:");
      log_info("  Target: {{Target}}");
      log_info("  Severity: {{severity}}");
      log_info("  Threads: {{threads}}");

      if (!file_exists("{{templates_path}}")) {
        log_warn("Templates path not found, using default");
      }
      return true;

  # Step 3: remote-bash (docker) - Run nuclei scan
  - name: nuclei-scan
    type: remote-bash
    step_runner: docker
    step_runner_config:
      image: "projectdiscovery/nuclei:latest"
      volumes:
        - "{{Output}}:/output"
        - "{{templates_path}}:/templates"
    command: "nuclei -u {{Target}} -t /templates -severity {{severity}} -c {{threads}} -o /output/vulns/nuclei.json -jsonl"
    timeout: 7200
    on_error: continue
    exports:
      nuclei_results: "{{vulns_dir}}/nuclei.json"

  # Step 4: bash - Run local vulnerability checks
  - name: local-vuln-checks
    type: bash
    parallel_commands:
      - "{{Binaries}}/nikto -h {{Target}} -output {{vulns_dir}}/nikto.txt -Format txt"
      - "{{Binaries}}/whatweb {{Target}} --log-json={{vulns_dir}}/whatweb.json"
    timeout: 1800
    on_error: continue

  # Step 5: foreach - Check each finding for exploitability
  - name: verify-findings
    type: foreach
    pre_condition: "file_exists('{{nuclei_results}}')"
    input: "{{nuclei_results}}"
    variable: finding
    threads: 5
    step:
      name: verify-single
      type: function
      script: |
        var finding = "[[finding]]";
        log_debug("Verifying finding: " + finding);
        return true;
      on_error: continue

  # Step 6: parallel-steps - Additional scanning modules
  - name: extended-scanning
    type: parallel-steps
    parallel_steps:
      - name: ssl-check
        type: bash
        command: "{{Binaries}}/testssl --jsonfile={{vulns_dir}}/ssl.json {{Target}}"
        timeout: 600
        on_error: continue
      - name: header-check
        type: bash
        command: "curl -sI {{Target}} | tee {{vulns_dir}}/headers.txt"
        timeout: 60
      - name: cors-check
        type: bash
        command: "{{Binaries}}/corsy -u {{Target}} -o {{vulns_dir}}/cors.json"
        timeout: 300
        on_error: continue

  # Step 7: function - Aggregate and calculate risk score
  - name: calculate-risk
    type: function
    script: |
      var critical = 0;
      var high = 0;
      var medium = 0;

      if (file_exists("{{nuclei_results}}")) {
        var content = read_file("{{nuclei_results}}");
        critical = (content.match(/critical/gi) || []).length;
        high = (content.match(/high/gi) || []).length;
        medium = (content.match(/medium/gi) || []).length;
      }

      var riskScore = (critical * 10) + (high * 5) + (medium * 2);
      log_info("Risk Score: " + riskScore);
      log_info("Critical: " + critical + ", High: " + high + ", Medium: " + medium);

      writeFile("{{findings_dir}}/risk-score.txt", "Risk Score: " + riskScore);
      return riskScore;
    exports:
      risk_score: "{{Result}}"

  # Step 8: bash - Generate final vulnerability report
  - name: generate-vuln-report
    type: bash
    commands:
      - |
        echo "# Vulnerability Assessment Report" > {{Output}}/vuln-report.md
        echo "Target: {{Target}}" >> {{Output}}/vuln-report.md
        echo "Date: $(date)" >> {{Output}}/vuln-report.md
        echo "Risk Score: {{risk_score}}" >> {{Output}}/vuln-report.md
        echo "" >> {{Output}}/vuln-report.md
        echo "## Findings" >> {{Output}}/vuln-report.md
        cat {{vulns_dir}}/nuclei.json 2>/dev/null | head -50 >> {{Output}}/vuln-report.md
    exports:
      vuln_report: "{{Output}}/vuln-report.md"