From 055430fdac5e12dcb894c57a7a719125ef25f157 Mon Sep 17 00:00:00 2001 From: Mark Pashby Date: Tue, 5 Jun 2018 12:01:29 +0100 Subject: [PATCH 1/7] Added gitignore and removed cred_sanner.py and requirements txt from root of repo. --- .gitignore | 104 +++++++++++++++++++++++++++++++++++++++++++++++ cred_scanner.py | 35 ---------------- requirements.txt | 1 - 3 files changed, 104 insertions(+), 36 deletions(-) create mode 100644 .gitignore delete mode 100644 cred_scanner.py delete mode 100644 requirements.txt diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..894a44c --- /dev/null +++ b/.gitignore @@ -0,0 +1,104 @@ +# Byte-compiled / optimized / DLL files +__pycache__/ +*.py[cod] +*$py.class + +# C extensions +*.so + +# Distribution / packaging +.Python +build/ +develop-eggs/ +dist/ +downloads/ +eggs/ +.eggs/ +lib/ +lib64/ +parts/ +sdist/ +var/ +wheels/ +*.egg-info/ +.installed.cfg +*.egg +MANIFEST + +# PyInstaller +# Usually these files are written by a python script from a template +# before PyInstaller builds the exe, so as to inject date/other infos into it. +*.manifest +*.spec + +# Installer logs +pip-log.txt +pip-delete-this-directory.txt + +# Unit test / coverage reports +htmlcov/ +.tox/ +.coverage +.coverage.* +.cache +nosetests.xml +coverage.xml +*.cover +.hypothesis/ +.pytest_cache/ + +# Translations +*.mo +*.pot + +# Django stuff: +*.log +local_settings.py +db.sqlite3 + +# Flask stuff: +instance/ +.webassets-cache + +# Scrapy stuff: +.scrapy + +# Sphinx documentation +docs/_build/ + +# PyBuilder +target/ + +# Jupyter Notebook +.ipynb_checkpoints + +# pyenv +.python-version + +# celery beat schedule file +celerybeat-schedule + +# SageMath parsed files +*.sage.py + +# Environments +.env +.venv +env/ +venv/ +ENV/ +env.bak/ +venv.bak/ + +# Spyder project settings +.spyderproject +.spyproject + +# Rope project settings +.ropeproject + +# mkdocs documentation +/site + +# mypy +.mypy_cache/ diff --git a/cred_scanner.py b/cred_scanner.py deleted file mode 100644 index e72cdcc..0000000 --- a/cred_scanner.py +++ /dev/null @@ -1,35 +0,0 @@ -import os -import re -import sys -import click - -@click.command() -@click.option('--path', default='.', help='Path other than the local directory to scan') -@click.option('--secret', is_flag=True, help='Also look for Secret Key patterns. This may result in many false matches due to the nature of secret keys.') -def scan(path, secret): - fail = False - for dirname, dirnames, filenames in os.walk(path): - # print path to all subdirectories first. - for subdirname in dirnames: - print(os.path.join(dirname, subdirname)) - - # print path to all filenames. - for filename in filenames: - click.echo(os.path.join(dirname, filename)) - f = open(os.path.join(dirname, filename)) - if secret: - pattern = re.compile('(? Date: Tue, 5 Jun 2018 12:02:30 +0100 Subject: [PATCH 2/7] Added modifications to README to include instructions to install project and autocomplete. --- README.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 9a66f33..03b068b 100644 --- a/README.md +++ b/README.md @@ -7,13 +7,17 @@ I suspect there are other, better tools out there (such as [git-secrets](https:/ To install just copy it where you want it and install the requirements: - pip install -r ./requirements.txt + pip install . This was written in Python 3.6. +To enable auto-complete, please add the following line to your bashrc/bash_profile:- + + /cred-scanner-complete.sh + To run: - python cred_scanner.py + cred_scanner That will scan the local directory and all subdirectories. It will list the files, which ones have potential access keys, and which files can't be scanned due to the file format. cred_scanner exits with a code of 1 if it finds any potential keys. From 71f824602a1d4408712f57f59da75bbb77d41038 Mon Sep 17 00:00:00 2001 From: Mark Pashby Date: Tue, 5 Jun 2018 12:03:05 +0100 Subject: [PATCH 3/7] Added bin dir with cred_scanner now shebanged. --- bin/cred_scanner | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100755 bin/cred_scanner diff --git a/bin/cred_scanner b/bin/cred_scanner new file mode 100755 index 0000000..9a2d253 --- /dev/null +++ b/bin/cred_scanner @@ -0,0 +1,37 @@ +#!/usr/bin/env python +import os +import re +import sys +import click + +@click.command() +@click.option('--path', default='.', help='Path other than the local directory to scan') +@click.option('--secret', is_flag=True, help='Also look for Secret Key patterns. This may result in many false matches due to the nature of secret keys.') +def scan(path, secret): + click.secho() + fail = False + for dirname, dirnames, filenames in os.walk(path): + # print path to all subdirectories first. + for subdirname in dirnames: + print(os.path.join(dirname, subdirname)) + + # print path to all filenames. + for filename in filenames: + click.echo(os.path.join(dirname, filename)) + f = open(os.path.join(dirname, filename)) + if secret: + pattern = re.compile('(? Date: Tue, 5 Jun 2018 12:03:18 +0100 Subject: [PATCH 4/7] Added in setup file for project. --- setup.py | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 setup.py diff --git a/setup.py b/setup.py new file mode 100644 index 0000000..6517c84 --- /dev/null +++ b/setup.py @@ -0,0 +1,10 @@ +from setuptools import setup + +setup(name='cred_scanner', + description='A simple command line tool for finding AWS credentials in files', + url='https://github.com/disruptops/cred_scanner', + author='DisruptOps', + license='MIT', + install_requires=['click'], + scripts=['bin/cred_scanner'], + zip_safe=False) From 8c56946b4555409e55cecd8339f7971698fa65ae Mon Sep 17 00:00:00 2001 From: Mark Pashby Date: Tue, 5 Jun 2018 12:03:45 +0100 Subject: [PATCH 5/7] Added in cred_scanner autocomplete bash script to support autocomplete. --- cred-scanner-complete.sh | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 cred-scanner-complete.sh diff --git a/cred-scanner-complete.sh b/cred-scanner-complete.sh new file mode 100644 index 0000000..210dd7a --- /dev/null +++ b/cred-scanner-complete.sh @@ -0,0 +1,8 @@ +_cred_scanner_completion() { + COMPREPLY=( $( env COMP_WORDS="${COMP_WORDS[*]}" \ + COMP_CWORD=$COMP_CWORD \ + _CRED_SCANNER_COMPLETE=complete $1 ) ) + return 0 +} + +complete -F _cred_scanner_completion -o default cred_scanner; From fc30db7b0d5f58717c516eb427064027f995fed5 Mon Sep 17 00:00:00 2001 From: Mark Pashby Date: Tue, 5 Jun 2018 13:45:55 +0100 Subject: [PATCH 6/7] Corrected missing text argument line that was used for testing. --- bin/cred_scanner | 1 - 1 file changed, 1 deletion(-) diff --git a/bin/cred_scanner b/bin/cred_scanner index 9a2d253..97a03b5 100755 --- a/bin/cred_scanner +++ b/bin/cred_scanner @@ -8,7 +8,6 @@ import click @click.option('--path', default='.', help='Path other than the local directory to scan') @click.option('--secret', is_flag=True, help='Also look for Secret Key patterns. This may result in many false matches due to the nature of secret keys.') def scan(path, secret): - click.secho() fail = False for dirname, dirnames, filenames in os.walk(path): # print path to all subdirectories first. From f16cb3eb89528b59d8e1c3c2611876999597be93 Mon Sep 17 00:00:00 2001 From: Mark Pashby Date: Tue, 5 Jun 2018 16:00:45 +0100 Subject: [PATCH 7/7] Corrected dot source instruction in README for the autocomplete script. --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 03b068b..042da6d 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ This was written in Python 3.6. To enable auto-complete, please add the following line to your bashrc/bash_profile:- - /cred-scanner-complete.sh + . /cred-scanner-complete.sh To run: @@ -29,4 +29,4 @@ That will scan the local directory and all subdirectories. It will list the file false matches due to the nature of secret keys. --help Show this message and exit. -To run as a test in Jenkins just use the command line or add it as a step to your Jenkins build. Jenkins will automatically fail the build if it sees the exit code 1. \ No newline at end of file +To run as a test in Jenkins just use the command line or add it as a step to your Jenkins build. Jenkins will automatically fail the build if it sees the exit code 1.