From 1c949b17b3e2e40d0dadbb4faf83000092314528 Mon Sep 17 00:00:00 2001 From: ramanan-ravi Date: Thu, 25 Jul 2024 19:13:03 +0530 Subject: [PATCH] Update docs --- Makefile | 2 +- README.md | 9 +++------ docs/docs/secretscanner/configure/cli.md | 2 +- docs/docs/secretscanner/configure/output.md | 2 +- docs/docs/secretscanner/img/secretscanner.svg | 2 +- docs/docs/secretscanner/quickstart.md | 6 +++--- docs/docs/secretscanner/using/build.md | 6 +++--- docs/docs/secretscanner/using/grpc.md | 2 +- docs/docs/secretscanner/using/scan.md | 4 ++-- 9 files changed, 16 insertions(+), 19 deletions(-) diff --git a/Makefile b/Makefile index e5f06e5..e29e4a0 100644 --- a/Makefile +++ b/Makefile @@ -17,4 +17,4 @@ SecretScanner: vendor $(PWD)/**/*.go $(PWD)/agent-plugins-grpc/**/*.go .PHONY: docker docker: - docker build -t quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 . + docker build -t quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 . diff --git a/README.md b/README.md index dcd4126..3533531 100644 --- a/README.md +++ b/README.md @@ -8,9 +8,6 @@ [![Slack](https://img.shields.io/badge/slack-@deepfence-blue.svg?logo=slack)](https://join.slack.com/t/deepfence-community/shared_invite/zt-podmzle9-5X~qYx8wMaLt9bGWwkSdgQ) [![Twitter](https://img.shields.io/twitter/url?style=social&url=https%3A%2F%2Fgithub.com%2Fdeepfence%2FSecretScanner)](https://twitter.com/intent/tweet?text=Check%20this%20out%3A&url=https%3A%2F%2Fgithub.com%2Fdeepfence%2FSecretScanner) - -> SecretScanner has been integrated into [ThreatMapper 1.3.0](https://github.com/deepfence/ThreatMapper), and also remains as this standalone project. - # SecretScanner Deepfence SecretScanner can find unprotected secrets in container images or file systems. @@ -41,12 +38,12 @@ Install docker and run SecretScanner on a container image using the following in * Build SecretScanner: ```shell ./bootstrap.sh -docker build --rm=true --tag=quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 -f Dockerfile . +docker build --rm=true --tag=quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 -f Dockerfile . ``` * Or, pull the latest build from docker hub by doing: ```shell -docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 +docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 ``` * Pull a container image for scanning: @@ -56,7 +53,7 @@ docker pull node:8.11 * Scan the container image: ```shell - docker run -i --rm --name=deepfence-secretscanner -v /var/run/docker.sock:/var/run/docker.sock quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 -image-name node:8.11 --output json > node.json + docker run -i --rm --name=deepfence-secretscanner -v /var/run/docker.sock:/var/run/docker.sock quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 -image-name node:8.11 --output json > node.json ``` # Credits diff --git a/docs/docs/secretscanner/configure/cli.md b/docs/docs/secretscanner/configure/cli.md index 6d42fa6..588904a 100644 --- a/docs/docs/secretscanner/configure/cli.md +++ b/docs/docs/secretscanner/configure/cli.md @@ -7,7 +7,7 @@ title: Command-Line Options Display the command line options: ```bash -docker run -it --rm quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 --help +docker run -it --rm quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 --help ``` or, with a standalone build: diff --git a/docs/docs/secretscanner/configure/output.md b/docs/docs/secretscanner/configure/output.md index 1b91c18..0e8e7ea 100644 --- a/docs/docs/secretscanner/configure/output.md +++ b/docs/docs/secretscanner/configure/output.md @@ -11,7 +11,7 @@ SecretScanner can writes output to `stdout` it can redirected to a file for furt docker run -it --rm --name=deepfence_secret_scanner \ -v /var/run/docker.sock:/var/run/docker.sock \ - quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 \ + quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 \ --image-name node:latest \ # highlight-next-line --output json > ./tmp/node-secret-scan.json diff --git a/docs/docs/secretscanner/img/secretscanner.svg b/docs/docs/secretscanner/img/secretscanner.svg index 2824671..5546df3 100644 --- a/docs/docs/secretscanner/img/secretscanner.svg +++ b/docs/docs/secretscanner/img/secretscanner.svg @@ -397,7 +397,7 @@ Deepfence SecretScanner - user@host:~$ d user@host:~$ do user@host:~$ doc user@host:~$ dock user@host:~$ docke user@host:~$ docker user@host:~$ docker user@host:~$ docker p user@host:~$ docker pu user@host:~$ docker pul user@host:~$ docker pull user@host:~$ docker pull user@host:~$ docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 user@host:~$ docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 user@host:~$ docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 latest: Pulling from quay.io/deepfenceio/deepfence_secret_scanner_ceDigest: sha256:6b295168d666e52512de5d2cb5d9722c18f0e3754bc2bd8f04f0a5e745025983Status: Image is up to date for quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0docker.io/quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0user@host:~$ user@host:~$ docker pull node:latest user@host:~$ docker pull node:latest user@host:~$ docker pull node:latest latest: Pulling from library/nodeDigest: sha256:a6f295c2354992f827693a2603c8b9b5b487db4da0714f5913a917ed588d6d41Status: Image is up to date for node:latestdocker.io/library/node:latestuser@host:~$ docker run user@host:~$ docker run -it user@host:~$ docker run -it --rm user@host:~$ docker run -it --rm --name=deepfence-secretscanner user@host:~$ docker run -it --rm --name=deepfence-secretscanner \ -v -v /var/run/docker.sock:/var/run/docker.sock -v /var/run/docker.sock:/var/run/docker.sock \ -v /tmp:/home/deepfence/output -v /tmp:/home/deepfence/output \ quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 \ --image-name --image-name node:latest --image-name node:latest --json-filename=node-secret-scan.json --image-name node:latest --json-filename=node-secret-scan.json --image-name node:latest --json-filename=node-secret-scan.json Initializing....Scanning image node:latest for secrets...connected successfully using endpoint: unix:///var/run/docker.sock container runtime detected: dockerScanning image /tmp/Deepfence/SecretScanning/df_nodelatest/save-output.tar for secrets... { "Image Layer ID": "e31e415306f711857958b20f8d105b603a084205f27dc3cb571916095ea3de15", "Matched Rule ID": 0, "Matched Rule Name": "Potential cryptographic private key", "Matched Part": "extension", "String to Match": ".pem", "Signature to Match": "", "Severity": "low", "Severity Score": 2.50, "Starting Index of Match in Original Content": 0, "Relative Starting Index of Match in Displayed Substring": 0, "Relative Ending Index of Match in Displayed Substring": 4, "Full File Name": "etc/ssl/certs/ACCVRAIZ1.pem", "Matched Contents": ".pem" }, "Image Layer ID": "83947950adda086956f93f4bd6f7568505b34c3b9017ad312b1c8c96d65608fb", "Matched Rule ID": 128, "Matched Rule Name": "netrc with SMTP credentials", "String to Match": ".netrc", "Relative Ending Index of Match in Displayed Substring": 6, "Full File Name": "usr/share/doc/git/contrib/credential/netrc/test.netrc", "Matched Contents": ".netrc" "Matched Rule ID": 118, "Matched Rule Name": "Username and password in URI", "Matched Part": "contents", "String to Match": "", "Signature to Match": "([\w+]{1,24})(://)([^$<]{1})([^\s\";]{1,}):([^$<]{1})([^\s\";/]{1,})@[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,24}([^\s]+)", "Severity": "high", "Severity Score": 7.59, "Starting Index of Match in Original Content": 12321, "Relative Starting Index of Match in Displayed Substring": 33, "Relative Ending Index of Match in Displayed Substring": 78, "Full File Name": "usr/share/perl/5.32.1/HTTP/Tiny.pm", "Matched Contents": "#pod $http->request('GET', 'http://john%40example.com:password@example.com/');" "Image Layer ID": "abcc9d89b3d7584095b901833ee94f78cb02b8532f590660e318c4ea66c40930", "Matched Rule ID": 85, "Matched Rule Name": "Potential Linux passwd file", "Matched Part": "path", "Signature to Match": "etc/passwd$", "Severity": "medium", "Severity Score": 5.00, "Relative Ending Index of Match in Displayed Substring": 10, "Full File Name": "etc/passwd", "Matched Contents": "etc/passwd" "Matched Rule ID": 84, "Matched Rule Name": "Potential Linux shadow file", "Signature to Match": "etc/shadow$", "Full File Name": "etc/shadow", "Matched Contents": "etc/shadow" "Image Layer ID": "d1a3146d3b79ccc975da537aed6041d11e9f201645b2992b1a268b4ac5d705f2", "Severity Score": 7.57, "Starting Index of Match in Original Content": 6399, "Relative Starting Index of Match in Displayed Substring": 8, "Relative Ending Index of Match in Displayed Substring": 45, "Full File Name": "usr/local/lib/node_modules/npm/node_modules/hosted-git-info/lib/index.js", "Matched Contents": "proto://username:password@hostname.com:user/repo" }{ "Timestamp": "2022-08-18 12:48:40.986444513 +00:00", "Image Name": "node:latest", "Image ID": "3adbe565b1f05545a12f2acd51b5e77207cec7f7cf4dd4caa725d4503cd4fe7a", "Secrets": [ ]}user@host:~$ c user@host:~$ ca user@host:~$ cat user@host:~$ cat user@host:~$ cat / user@host:~$ cat /t user@host:~$ cat /tm user@host:~$ cat /tmp user@host:~$ cat /tmp/ user@host:~$ cat /tmp/n user@host:~$ cat /tmp/no user@host:~$ cat /tmp/nod user@host:~$ cat /tmp/node user@host:~$ cat /tmp/node- user@host:~$ cat /tmp/node-s user@host:~$ cat /tmp/node-se user@host:~$ cat /tmp/node-sec user@host:~$ cat /tmp/node-secr user@host:~$ cat /tmp/node-secre user@host:~$ cat /tmp/node-secret user@host:~$ cat /tmp/node-secret- user@host:~$ cat /tmp/node-secret-s user@host:~$ cat /tmp/node-secret-sc user@host:~$ cat /tmp/node-secret-sca user@host:~$ cat /tmp/node-secret-scan user@host:~$ cat /tmp/node-secret-scan. user@host:~$ cat /tmp/node-secret-scan.j user@host:~$ cat /tmp/node-secret-scan.js user@host:~$ cat /tmp/node-secret-scan.jso user@host:~$ cat /tmp/node-secret-scan.json user@host:~$ cat /tmp/node-secret-scan.json user@host:~$ cat /tmp/node-secret-scan.json | user@host:~$ cat /tmp/node-secret-scan.json | user@host:~$ cat /tmp/node-secret-scan.json | j user@host:~$ cat /tmp/node-secret-scan.json | jq user@host:~$ cat /tmp/node-secret-scan.json | jq user@host:~$ cat /tmp/node-secret-scan.json | jq ' user@host:~$ cat /tmp/node-secret-scan.json | jq '. user@host:~$ cat /tmp/node-secret-scan.json | jq '.S user@host:~$ cat /tmp/node-secret-scan.json | jq '.Se user@host:~$ cat /tmp/node-secret-scan.json | jq '.Sec user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secr user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secre user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secret user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[ user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { r user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { ru user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rul user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: . user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ." user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."M user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Ma user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Mat user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Matc user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Match user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Matche user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Matched user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Matched R Ru Rul Rule Rule Rule N Rule Na Rule Nam Rule Name Rule Name" Rule Name", Rule Name", Rule Name", f Rule Name", fi Rule Name", fil Rule Name", file Rule Name", file: Rule Name", file: Rule Name", file: . Rule Name", file: ." Rule Name", file: ."F Rule Name", file: ."Fu Rule Name", file: ."Ful Rule Name", file: ."Full Rule Name", file: ."Full Rule Name", file: ."Full F Rule Name", file: ."Full Fi Rule Name", file: ."Full Fil Rule Name", file: ."Full File Rule Name", file: ."Full File Rule Name", file: ."Full File N Rule Name", file: ."Full File Na Rule Name", file: ."Full File Nam Rule Name", file: ."Full File Name Rule Name", file: ."Full File Name" Rule Name", file: ."Full File Name" Rule Name", file: ."Full File Name" } Rule Name", file: ."Full File Name" }' Rule Name", file: ."Full File Name" }' Rule Name", file: ."Full File Name" }'cat zz | jq '.Secrets[] | { rule: ."Matched Rule Name", file: ."Full File Name" }'}'{ "rule": "Potential cryptographic private key", "file": "etc/ssl/certs/ACCVRAIZ1.pem"} "rule": "netrc with SMTP credentials", "file": "usr/share/doc/git/contrib/credential/netrc/test.netrc" "rule": "Username and password in URI", "file": "usr/share/perl/5.32.1/HTTP/Tiny.pm" "rule": "Potential Linux passwd file", "file": "etc/passwd" "rule": "Potential Linux shadow file", "file": "etc/shadow" "file": "usr/local/lib/node_modules/npm/node_modules/hosted-git-info/lib/index.js" + user@host:~$ d user@host:~$ do user@host:~$ doc user@host:~$ dock user@host:~$ docke user@host:~$ docker user@host:~$ docker user@host:~$ docker p user@host:~$ docker pu user@host:~$ docker pul user@host:~$ docker pull user@host:~$ docker pull user@host:~$ docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 user@host:~$ docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 user@host:~$ docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 latest: Pulling from quay.io/deepfenceio/deepfence_secret_scanner_ceDigest: sha256:6b295168d666e52512de5d2cb5d9722c18f0e3754bc2bd8f04f0a5e745025983Status: Image is up to date for quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0docker.io/quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0user@host:~$ user@host:~$ docker pull node:latest user@host:~$ docker pull node:latest user@host:~$ docker pull node:latest latest: Pulling from library/nodeDigest: sha256:a6f295c2354992f827693a2603c8b9b5b487db4da0714f5913a917ed588d6d41Status: Image is up to date for node:latestdocker.io/library/node:latestuser@host:~$ docker run user@host:~$ docker run -it user@host:~$ docker run -it --rm user@host:~$ docker run -it --rm --name=deepfence-secretscanner user@host:~$ docker run -it --rm --name=deepfence-secretscanner \ -v -v /var/run/docker.sock:/var/run/docker.sock -v /var/run/docker.sock:/var/run/docker.sock \ -v /tmp:/home/deepfence/output -v /tmp:/home/deepfence/output \ quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 \ --image-name --image-name node:latest --image-name node:latest --json-filename=node-secret-scan.json --image-name node:latest --json-filename=node-secret-scan.json --image-name node:latest --json-filename=node-secret-scan.json Initializing....Scanning image node:latest for secrets...connected successfully using endpoint: unix:///var/run/docker.sock container runtime detected: dockerScanning image /tmp/Deepfence/SecretScanning/df_nodelatest/save-output.tar for secrets... { "Image Layer ID": "e31e415306f711857958b20f8d105b603a084205f27dc3cb571916095ea3de15", "Matched Rule ID": 0, "Matched Rule Name": "Potential cryptographic private key", "Matched Part": "extension", "String to Match": ".pem", "Signature to Match": "", "Severity": "low", "Severity Score": 2.50, "Starting Index of Match in Original Content": 0, "Relative Starting Index of Match in Displayed Substring": 0, "Relative Ending Index of Match in Displayed Substring": 4, "Full File Name": "etc/ssl/certs/ACCVRAIZ1.pem", "Matched Contents": ".pem" }, "Image Layer ID": "83947950adda086956f93f4bd6f7568505b34c3b9017ad312b1c8c96d65608fb", "Matched Rule ID": 128, "Matched Rule Name": "netrc with SMTP credentials", "String to Match": ".netrc", "Relative Ending Index of Match in Displayed Substring": 6, "Full File Name": "usr/share/doc/git/contrib/credential/netrc/test.netrc", "Matched Contents": ".netrc" "Matched Rule ID": 118, "Matched Rule Name": "Username and password in URI", "Matched Part": "contents", "String to Match": "", "Signature to Match": "([\w+]{1,24})(://)([^$<]{1})([^\s\";]{1,}):([^$<]{1})([^\s\";/]{1,})@[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,24}([^\s]+)", "Severity": "high", "Severity Score": 7.59, "Starting Index of Match in Original Content": 12321, "Relative Starting Index of Match in Displayed Substring": 33, "Relative Ending Index of Match in Displayed Substring": 78, "Full File Name": "usr/share/perl/5.32.1/HTTP/Tiny.pm", "Matched Contents": "#pod $http->request('GET', 'http://john%40example.com:password@example.com/');" "Image Layer ID": "abcc9d89b3d7584095b901833ee94f78cb02b8532f590660e318c4ea66c40930", "Matched Rule ID": 85, "Matched Rule Name": "Potential Linux passwd file", "Matched Part": "path", "Signature to Match": "etc/passwd$", "Severity": "medium", "Severity Score": 5.00, "Relative Ending Index of Match in Displayed Substring": 10, "Full File Name": "etc/passwd", "Matched Contents": "etc/passwd" "Matched Rule ID": 84, "Matched Rule Name": "Potential Linux shadow file", "Signature to Match": "etc/shadow$", "Full File Name": "etc/shadow", "Matched Contents": "etc/shadow" "Image Layer ID": "d1a3146d3b79ccc975da537aed6041d11e9f201645b2992b1a268b4ac5d705f2", "Severity Score": 7.57, "Starting Index of Match in Original Content": 6399, "Relative Starting Index of Match in Displayed Substring": 8, "Relative Ending Index of Match in Displayed Substring": 45, "Full File Name": "usr/local/lib/node_modules/npm/node_modules/hosted-git-info/lib/index.js", "Matched Contents": "proto://username:password@hostname.com:user/repo" }{ "Timestamp": "2022-08-18 12:48:40.986444513 +00:00", "Image Name": "node:latest", "Image ID": "3adbe565b1f05545a12f2acd51b5e77207cec7f7cf4dd4caa725d4503cd4fe7a", "Secrets": [ ]}user@host:~$ c user@host:~$ ca user@host:~$ cat user@host:~$ cat user@host:~$ cat / user@host:~$ cat /t user@host:~$ cat /tm user@host:~$ cat /tmp user@host:~$ cat /tmp/ user@host:~$ cat /tmp/n user@host:~$ cat /tmp/no user@host:~$ cat /tmp/nod user@host:~$ cat /tmp/node user@host:~$ cat /tmp/node- user@host:~$ cat /tmp/node-s user@host:~$ cat /tmp/node-se user@host:~$ cat /tmp/node-sec user@host:~$ cat /tmp/node-secr user@host:~$ cat /tmp/node-secre user@host:~$ cat /tmp/node-secret user@host:~$ cat /tmp/node-secret- user@host:~$ cat /tmp/node-secret-s user@host:~$ cat /tmp/node-secret-sc user@host:~$ cat /tmp/node-secret-sca user@host:~$ cat /tmp/node-secret-scan user@host:~$ cat /tmp/node-secret-scan. user@host:~$ cat /tmp/node-secret-scan.j user@host:~$ cat /tmp/node-secret-scan.js user@host:~$ cat /tmp/node-secret-scan.jso user@host:~$ cat /tmp/node-secret-scan.json user@host:~$ cat /tmp/node-secret-scan.json user@host:~$ cat /tmp/node-secret-scan.json | user@host:~$ cat /tmp/node-secret-scan.json | user@host:~$ cat /tmp/node-secret-scan.json | j user@host:~$ cat /tmp/node-secret-scan.json | jq user@host:~$ cat /tmp/node-secret-scan.json | jq user@host:~$ cat /tmp/node-secret-scan.json | jq ' user@host:~$ cat /tmp/node-secret-scan.json | jq '. user@host:~$ cat /tmp/node-secret-scan.json | jq '.S user@host:~$ cat /tmp/node-secret-scan.json | jq '.Se user@host:~$ cat /tmp/node-secret-scan.json | jq '.Sec user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secr user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secre user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secret user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[ user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { r user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { ru user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rul user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: . user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ." user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."M user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Ma user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Mat user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Matc user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Match user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Matche user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Matched user@host:~$ cat /tmp/node-secret-scan.json | jq '.Secrets[] | { rule: ."Matched R Ru Rul Rule Rule Rule N Rule Na Rule Nam Rule Name Rule Name" Rule Name", Rule Name", Rule Name", f Rule Name", fi Rule Name", fil Rule Name", file Rule Name", file: Rule Name", file: Rule Name", file: . Rule Name", file: ." Rule Name", file: ."F Rule Name", file: ."Fu Rule Name", file: ."Ful Rule Name", file: ."Full Rule Name", file: ."Full Rule Name", file: ."Full F Rule Name", file: ."Full Fi Rule Name", file: ."Full Fil Rule Name", file: ."Full File Rule Name", file: ."Full File Rule Name", file: ."Full File N Rule Name", file: ."Full File Na Rule Name", file: ."Full File Nam Rule Name", file: ."Full File Name Rule Name", file: ."Full File Name" Rule Name", file: ."Full File Name" Rule Name", file: ."Full File Name" } Rule Name", file: ."Full File Name" }' Rule Name", file: ."Full File Name" }' Rule Name", file: ."Full File Name" }'cat zz | jq '.Secrets[] | { rule: ."Matched Rule Name", file: ."Full File Name" }'}'{ "rule": "Potential cryptographic private key", "file": "etc/ssl/certs/ACCVRAIZ1.pem"} "rule": "netrc with SMTP credentials", "file": "usr/share/doc/git/contrib/credential/netrc/test.netrc" "rule": "Username and password in URI", "file": "usr/share/perl/5.32.1/HTTP/Tiny.pm" "rule": "Potential Linux passwd file", "file": "etc/passwd" "rule": "Potential Linux shadow file", "file": "etc/shadow" "file": "usr/local/lib/node_modules/npm/node_modules/hosted-git-info/lib/index.js" diff --git a/docs/docs/secretscanner/quickstart.md b/docs/docs/secretscanner/quickstart.md index 089cc69..36e8bc2 100644 --- a/docs/docs/secretscanner/quickstart.md +++ b/docs/docs/secretscanner/quickstart.md @@ -9,7 +9,7 @@ Pull the latest SecretScanner image, and use it to scan a `node:latest` containe ## Pull the latest SecretScanner image ```bash -docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 +docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 ``` ## Scan a Container Image @@ -21,7 +21,7 @@ docker pull node:latest docker run -i --rm --name=deepfence-secretscanner \ -v /var/run/docker.sock:/var/run/docker.sock \ - quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 \ + quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 \ -image-name node:latest docker rmi node:latest @@ -34,7 +34,7 @@ You can summarise the results by processing the JSON output, e.g. using `jq`: ```bash docker run -i --rm --name=deepfence-secretscanner \ -v /var/run/docker.sock:/var/run/docker.sock \ - quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 \ + quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 \ --image-name node:latest \ --output json > /tmp/node-secret-scan.json diff --git a/docs/docs/secretscanner/using/build.md b/docs/docs/secretscanner/using/build.md index 1eca549..91da0b2 100644 --- a/docs/docs/secretscanner/using/build.md +++ b/docs/docs/secretscanner/using/build.md @@ -8,11 +8,11 @@ SecretScanner is a self-contained docker-based tool. Clone the [SecretScanner re ```bash ./bootstrap.sh -docker build --rm=true --tag=quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 -f Dockerfile . +docker build --rm=true --tag=quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 -f Dockerfile . ``` -Alternatively, you can pull the official Deepfence image at `quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0`: +Alternatively, you can pull the official Deepfence image at `quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0`: ```bash -docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 +docker pull quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 ``` \ No newline at end of file diff --git a/docs/docs/secretscanner/using/grpc.md b/docs/docs/secretscanner/using/grpc.md index 8fee370..165355a 100644 --- a/docs/docs/secretscanner/using/grpc.md +++ b/docs/docs/secretscanner/using/grpc.md @@ -27,7 +27,7 @@ docker run -it --rm --name=deepfence-secretscanner \ -v $(pwd):/home/deepfence/output \ -v /var/run/docker.sock:/var/run/docker.sock \ -v /tmp/sock:/tmp/sock \ - quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 \ + quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 \ -socket-path /tmp/sock/s.sock ``` diff --git a/docs/docs/secretscanner/using/scan.md b/docs/docs/secretscanner/using/scan.md index 9e33565..f873240 100644 --- a/docs/docs/secretscanner/using/scan.md +++ b/docs/docs/secretscanner/using/scan.md @@ -15,7 +15,7 @@ docker pull node:latest docker run -it --rm --name=deepfence-secretscanner \ -v /var/run/docker.sock:/var/run/docker.sock \ - quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 \ + quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 \ # highlight-next-line --image-name node:latest @@ -30,7 +30,7 @@ Mount the filesystem within the SecretScanner container and scan it. Here, we s docker run -it --rm --name=deepfence-secretscanner \ # highlight-next-line -v /tmp:/deepfence/mnt \ - quay.io/deepfenceio/deepfence_secret_scanner_ce:2.2.0 \ + quay.io/deepfenceio/deepfence_secret_scanner_ce:2.3.0 \ # highlight-next-line --host-mount-path /deepfence/mnt --local /deepfence/mnt ```