pwn 0.5.508 → 0.5.509

data/bin/pwn_zaproxy_active_rest_api_scan

@@ -1,159 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'fileutils'
-require 'pwn'
-require 'uri'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-aAPIKEY', '--api_key=APIKEY', '<Required - OWASP Zap API Key (Tools>Options>API)>') do |a|
-    opts[:api_key] = a
-  end
-
-  options.on('-tTARGET', '--target_url=TARGET', '<Required - Target URI to Scan>') do |t|
-    opts[:target_url] = t
-  end
-
-  options.on('-oDIR', '--report_output_dir=DIR', '<Required -  Output Directory for Active Scan Report>') do |o|
-    opts[:output_dir] = o
-  end
-
-  options.on('-dSWAGGER', '--swagger_definitions=SWAGGER', '<Required - Comma-delimited list of Swagger JSON/YAML files to import>') do |s|
-    opts[:swagger_definitions] = s
-  end
-
-  options.on('-zZPATH', '--zap_bin_path=ZPATH', '<Optional - Path to zap.sh>') do |z|
-    opts[:zap_bin_path] = z
-  end
-
-  options.on('-h', '--[no-]headless', '<Optional - Run ZAP and Browser Headless>') do |h|
-    opts[:headless] = h
-  end
-
-  options.on('-bTYPE', '--browser_type=TYPE', '<Optional - Browser Type <firefox|chrome|headless|rest> (Defaults to firefox)>') do |b|
-    opts[:browser_type] = b
-  end
-
-  options.on('-D', '--[no-]debug', '<Optional - Enable Debug Output and Do Not Delete Temporary OpenAPI Spec>') do |d|
-    opts[:debug] = d
-  end
-
-  options.on('-vVERSION', '--openapi_spec_version=VERSION', '<Optional - OpenAPI/Swagger Specification Version (Defaults to 3.0.3)>') do |o|
-    opts[:openapi_spec_version] = o
-  end
-
-  options.on('-HJSON', '--additional_http_headers=JSON', '<Optional - JSON string of additional HTTP headers to include in requests (e.g. \'{"Header1":"Value1","Header2":"Value2"}\')>') do |h|
-    opts[:additional_http_headers] = h
-  end
-
-  options.on('-eLIST', '--exclude_paths=LIST', '<Optional - Comma-delimited list of paths to exlude from scanning (e.g. "/api/login, /api/logout, /api/etc")>') do |e|
-    opts[:exclude_paths] = e
-  end
-
-  options.on('-iURL', '--in_scope=URL', '<Optional - URL regex to include in scope (Defaults to "<target_url>.*")>') do |s|
-    opts[:in_scope] = s
-  end
-end.parse!
-
-begin
-  timestamp = Time.now.strftime('%Y-%m-%d_%H-%M-%S%Z')
-  logger = PWN::Plugins::PWNLogger.create
-
-  api_key = opts[:api_key]
-  raise 'ERROR: --api_key is required.' if api_key.nil?
-
-  target_url = opts[:target_url]
-  raise 'ERROR: --target_url is required.' if target_url.nil?
-
-  output_dir = opts[:output_dir]
-  raise 'ERROR: --report_output_dir is required.' if output_dir.nil?
-
-  swagger_definitions = opts[:swagger_definitions]
-  raise 'ERROR: --swagger_definitions is required.' if swagger_definitions.nil?
-
-  zap_bin_path = opts[:zap_bin_path]
-  headless = opts[:headless] || false
-  browser_type = opts[:browser_type] ||= :firefox
-  debug = opts[:debug] || false
-
-  swagger_defs_arr = swagger_definitions.split(',').map(&:strip)
-  scheme = URI.parse(target_url).scheme
-  target_host = URI.parse(target_url).host
-  base_url = "#{scheme}://#{target_host}"
-
-  openapi_spec_version = opts[:openapi_spec_version]
-  openapi_spec_root = File.dirname(swagger_defs_arr.first)
-  openapi_spec = "#{openapi_spec_root}/openapi_spec-#{target_host}-#{timestamp}.json"
-
-  PWN::Plugins::OpenAPI.generate_spec(
-    spec_paths: swagger_defs_arr,
-    base_url: base_url,
-    output_json_path: openapi_spec,
-    target_version: openapi_spec_version,
-    debug: debug
-  )
-
-  additional_http_headers = opts[:additional_http_headers]
-  exlude_paths = opts[:exclude_paths]
-  exlude_paths = exlude_paths.split(',').map(&:strip) if exlude_paths.is_a?(String)
-
-  in_scope = opts[:in_scope] ||= "#{target_url}.*"
-
-  # ------
-  # Open ZAP
-  if headless
-    zap_obj = PWN::Plugins::Zaproxy.start(
-      zap_bin_path: zap_bin_path,
-      api_key: api_key,
-      headless: headless
-    )
-  else
-    zap_obj = PWN::Plugins::Zaproxy.start(
-      zap_bin_path: zap_bin_path,
-      api_key: api_key,
-      browser_type: browser_type
-    )
-  end
-
-  logger.info(zap_obj)
-
-  additional_http_headers = JSON.parse(additional_http_headers, symbolize_names: true) if additional_http_headers.is_a?(String)
-  json_sitemap = PWN::Plugins::Zaproxy.import_openapi_to_sitemap(
-    zap_obj: zap_obj,
-    openapi_spec: openapi_spec,
-    additional_http_headers: additional_http_headers,
-    target_regex: in_scope
-  )
-  raise "ERROR: Failed to import OpenAPI/Swagger spec #{openapi_spec} into ZAP's Sitemap." if json_sitemap.nil? || json_sitemap.empty?
-
-  PWN::Plugins::Zaproxy.add_to_scope(
-    zap_obj: zap_obj,
-    target_regex: in_scope
-  )
-
-  PWN::Plugins::Zaproxy.active_scan(
-    zap_obj: zap_obj,
-    target_url: in_scope,
-    exclude_paths: exlude_paths
-  )
-
-  # Dump a list of scan issues from Active Scan result
-  # scan_issues = PWN::Plugins::Zaproxy.get_scan_issues(zap_obj: zap_obj)
-  # puts scan_issues
-
-  # Once DefectDojo begins to support XML report results
-  report_types = %i[html markdown xml]
-  report_types.each do |report_type|
-    PWN::Plugins::Zaproxy.generate_scan_report(
-      zap_obj: zap_obj,
-      target_url: in_scope,
-      report_type: report_type,
-      output_dir: output_dir
-    )
-  end
-rescue StandardError => e
-  raise e
-ensure
-  PWN::Plugins::Zaproxy.stop(zap_obj: zap_obj) unless zap_obj.nil?
-end

data/bin/pwn_zaproxy_active_scan

@@ -1,130 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'pwn'
-
-opts = PWN::Env[:driver_opts]
-PWN::Driver::Parser.new do |options|
-  options.on('-aAPIKEY', '--api_key=APIKEY', '<Required - OWASP Zap API Key (Tools>Options>API)>') do |a|
-    opts[:api_key] = a
-  end
-
-  options.on('-tTARGET', '--target_url=TARGET', '<Required - Target URI to Scan>') do |t|
-    opts[:target_url] = t
-  end
-
-  options.on('-oDIR', '--report_output_dir=DIR', '<Required - Output Directory for Active Scan Report>') do |o|
-    opts[:output_dir] = o
-  end
-
-  options.on('-eLIST', '--exclude_paths=LIST', '<Optional - Comma-delimited list of paths to exlude from scanning (e.g. "/api/login, /api/logout, /api/etc")>') do |e|
-    opts[:exclude_paths] = e
-  end
-
-  options.on('-zZPATH', '--zap_bin_path=ZPATH', '<Optional - Path to zap.sh>') do |z|
-    opts[:zap_bin_path] = z
-  end
-
-  options.on('-h', '--[no-]headless', '<Optional - Run OWASP Zap Headless>') do |h|
-    opts[:headless] = h
-  end
-
-  options.on('-bTYPE', '--browser_type=TYPE', '<Optional - Browser Type <firefox|chrome|headless|rest> (Defaults to firefox)>') do |b|
-    opts[:browser_type] = b
-  end
-
-  options.on('-s', '--[no-]spider', '<Optional - Crawl / Spider Target Prior to Scanning (Defaults to false)>') do |s|
-    opts[:spider] = s
-  end
-
-  options.on('-IINST', '--navigation_instruct=INST', '<Optional - Path to Navigation Instructions (e.g. Auth w/ Target - see /pwn/etc/owasp_zap/navigation.instruct.EXAMPLE)>') do |i|
-    opts[:navigation_instruct] = i
-  end
-
-  options.on('-iURL', '--in_scope=URL', '<Optional - URL regex to include in scope (Defaults to "<target_url>.*")>') do |s|
-    opts[:in_scope] = s
-  end
-end.parse!
-
-begin
-  logger = PWN::Plugins::PWNLogger.create
-
-  api_key = opts[:api_key]
-  raise 'ERROR: --api_key is required.' if api_key.nil?
-
-  target_url = opts[:target_url]
-  raise 'ERROR: --target_url is required.' if target_url.nil?
-
-  output_dir = opts[:output_dir]
-  raise 'ERROR: --report_output_dir is required.' if output_dir.nil?
-
-  exlude_paths = opts[:exclude_paths]
-  exlude_paths = exlude_paths.split(',').map(&:strip) if exlude_paths.is_a?(String)
-  zap_bin_path = opts[:zap_bin_path].to_s.strip.chomp.scrub if File.exist?(opts[:zap_bin_path].to_s.strip.chomp.scrub)
-  headless = opts[:headless] || false
-  browser_type = opts[:browser_type] ||= :firefox
-  spider = opts[:spider] || false
-  navigation_instruct = opts[:navigation_instruct]
-  in_scope = opts[:in_scope] ||= "#{target_url}.*"
-
-  # ------
-  # Dynamically build arguments hash based on flags passed and Open Zap
-  if headless
-    zap_obj = PWN::Plugins::Zaproxy.start(
-      zap_bin_path: zap_bin_path,
-      api_key: api_key,
-      headless: headless
-    )
-  else
-    zap_obj = PWN::Plugins::Zaproxy.start(
-      zap_bin_path: zap_bin_path,
-      api_key: api_key,
-      browser_type: browser_type
-    )
-  end
-
-  logger.info(zap_obj)
-
-  browser_obj = zap_obj[:mitm_browser]
-  browser = browser_obj[:browser]
-  browser.goto(target_url)
-
-  if navigation_instruct
-    File.read(navigation_instruct).each_line do |instruction|
-      # Look for any set method in this instruction and replace its value w/ asterisks
-      redact_regex = /\.set\(['"]([^'"]*)['"]\)/
-      redacted_instruction = instruction.gsub(redact_regex, ".set('********')")
-      print "\nExecuting Instruction: #{redacted_instruction}"
-      browser.instance_eval(instruction.to_s.scrub.strip.chomp)
-    end
-  end
-
-  PWN::Plugins::Zaproxy.spider(zap_obj: zap_obj, target_url: target_url) if spider
-
-  PWN::Plugins::Zaproxy.add_to_scope(
-    zap_obj: zap_obj,
-    target_regex: in_scope
-  )
-
-  PWN::Plugins::Zaproxy.active_scan(
-    zap_obj: zap_obj,
-    target_url: in_scope,
-    exclude_paths: exlude_paths
-  )
-
-  # Generate all Report Types
-  report_types = %i[html markdown xml]
-  report_types.each do |report_type|
-    report_path = PWN::Plugins::Zaproxy.generate_scan_report(
-      zap_obj: zap_obj,
-      output_dir: output_dir,
-      report_type: report_type
-    )
-
-    logger.info("Report can be found here: #{report_path}")
-  end
-rescue StandardError => e
-  raise e
-ensure
-  PWN::Plugins::Zaproxy.stop(zap_obj: zap_obj) unless zap_obj.nil?
-end

data/build_pwn_gem.sh

@@ -1,33 +0,0 @@
-#!/bin/bash --login
-if [[ -d '/opt/pwn' ]]; then
-  pwn_root='/opt/pwn' 
-else
-  pwn_root="${PWN_ROOT}"
-fi
-
-ls pkg/*.gem | while read previous_gems; do 
-  rvmsudo rm $previous_gems
-done
-old_ruby_version=`cat ${pwn_root}/.ruby-version`
-# Default Strategy is to merge codebase
-rvmsudo git config pull.rebase false 
-rvmsudo git pull
-new_ruby_version=`cat ${pwn_root}/.ruby-version`
-
-rvmsudo gem update --system
-
-if [[ $old_ruby_version == $new_ruby_version ]]; then
-  export rvmsudo_secure_path=1
-  rvmsudo /bin/bash --login -c "cd ${pwn_root} && ./reinstall_pwn_gemset.sh"
-  cd /tmp && cd $pwn_root
-  rvmsudo rake
-  rvmsudo rake install
-  rvmsudo rake rerdoc
-  rvmsudo gem rdoc --backtrace --rdoc --ri --overwrite -V pwn
-  echo "Invoking bundle-audit Gemfile Scanner..."
-  rvmsudo bundle-audit
-else
-  cd $pwn_root && ./upgrade_ruby.sh $new_ruby_version $old_ruby_version
-fi
-
-cd $pwn_root && bundle fund | grep -A 1 pwn

data/documentation/frozen_string_literal_files_changed_from_false_to_true.txt

@@ -1,54 +0,0 @@
-bin/pwn_shodan_search:# frozen_string_literal: false
-bin/pwn_sast:# frozen_string_literal: false
-bin/pwn_www_uri_buster:# frozen_string_literal: false
-bin/pwn_bdba_scan:# frozen_string_literal: false
-bin/pwn_serial_msr206:# frozen_string_literal: false
-bin/pwn_bdba_groups:# frozen_string_literal: false
-bin/pwn_serial_son_micro_sm132_rfid:# frozen_string_literal: false
-bin/pwn_gqrx_scanner:# frozen_string_literal: false
-bin/pwn_nmap_discover_tcp_udp:# frozen_string_literal: false
-lib/pwn/sast/beef_hook.rb:# frozen_string_literal: false
-lib/pwn/sast/local_storage.rb:# frozen_string_literal: false
-lib/pwn/sast/post_message.rb:# frozen_string_literal: false
-lib/pwn/sast/factory.rb:# frozen_string_literal: false
-lib/pwn/sast/base64.rb:# frozen_string_literal: false
-lib/pwn/sast/shell.rb:# frozen_string_literal: false
-lib/pwn/sast/aws.rb:# frozen_string_literal: false
-lib/pwn/sast/token.rb:# frozen_string_literal: false
-lib/pwn/sast/port.rb:# frozen_string_literal: false
-lib/pwn/sast/throw_errors.rb:# frozen_string_literal: false
-lib/pwn/sast/pom_version.rb:# frozen_string_literal: false
-lib/pwn/sast/outer_html.rb:# frozen_string_literal: false
-lib/pwn/sast/window_location_hash.rb:# frozen_string_literal: false
-lib/pwn/sast/deserial_java.rb:# frozen_string_literal: false
-lib/pwn/sast/php_input_mechanisms.rb:# frozen_string_literal: false
-lib/pwn/sast/redos.rb:# frozen_string_literal: false
-lib/pwn/sast/cmd_execution_python.rb:# frozen_string_literal: false
-lib/pwn/sast/type_script_type_juggling.rb:# frozen_string_literal: false
-lib/pwn/sast/version.rb:# frozen_string_literal: false
-lib/pwn/sast/sql.rb:# frozen_string_literal: false
-lib/pwn/sast/emoticon.rb:# frozen_string_literal: false
-lib/pwn/sast/redirect.rb:# frozen_string_literal: false
-lib/pwn/sast/cmd_execution_ruby.rb:# frozen_string_literal: false
-lib/pwn/sast/cmd_execution_java.rb:# frozen_string_literal: false
-lib/pwn/sast/private_key.rb:# frozen_string_literal: false
-lib/pwn/sast/location_hash.rb:# frozen_string_literal: false
-lib/pwn/sast/password.rb:# frozen_string_literal: false
-lib/pwn/sast/php_type_juggling.rb:# frozen_string_literal: false
-lib/pwn/sast/padding_oracle.rb:# frozen_string_literal: false
-lib/pwn/sast/md5.rb:# frozen_string_literal: false
-lib/pwn/sast/http_authorization_header.rb:# frozen_string_literal: false
-lib/pwn/sast/amqp_connect_as_guest.rb:# frozen_string_literal: false
-lib/pwn/sast/signature.rb:# frozen_string_literal: false
-lib/pwn/sast/apache_file_system_util_api.rb:# frozen_string_literal: false
-lib/pwn/sast/keystore.rb:# frozen_string_literal: false
-lib/pwn/sast/log4j.rb:# frozen_string_literal: false
-lib/pwn/sast/inner_html.rb:# frozen_string_literal: false
-lib/pwn/sast/task_tag.rb:# frozen_string_literal: false
-lib/pwn/sast/csrf.rb:# frozen_string_literal: false
-lib/pwn/sast/eval.rb:# frozen_string_literal: false
-lib/pwn/sast/logger.rb:# frozen_string_literal: false
-lib/pwn/sast/sudo.rb:# frozen_string_literal: false
-lib/pwn/sast/ssl.rb:# frozen_string_literal: false
-lib/pwn/sast/cmd_execution_scala.rb:# frozen_string_literal: false
-lib/pwn/sast/banned_function_calls_c.rb:# frozen_string_literal: false

data/etc/systemd/msfrpcd.service

@@ -1,12 +0,0 @@
-[Unit]
-Description=RPC interface to the Metasploit Framework
-
-[Service]
-User=root
-RemainAfterExit=yes
-ExecStart=/bin/bash --login -c "msf_ruby_v=$(cat /opt/metasploit-framework-dev/.ruby-version) && source /etc/profile.d/rvm.sh && rvm use ruby-$msf_ruby_v@metasploit-framework && $PWN_ROOT/packer/daemons/msfrpcd.rb --action start"
-ExecReload=/bin/bash --login -c "msf_ruby_v=$(cat /opt/metasploit-framework-dev/.ruby-version) && source /etc/profile.d/rvm.sh && rvm use ruby-$msf_ruby_v@metasploit-framework && $PWN_ROOT/packer/daemons/msfrpcd.rb --action reload"
-ExecStop=/bin/bash --login -c "msf_ruby_v=$(cat /opt/metasploit-framework-dev/.ruby-version) && source /etc/profile.d/rvm.sh && rvm use ruby-$msf_ruby_v@metasploit-framework && $PWN_ROOT/packer/daemons/msfrpcd.rb --action stop"
-
-[Install]
-WantedBy=multi-user.target

data/etc/systemd/openvas.service

@@ -1,14 +0,0 @@
-[Unit]
-Description=Open Vulnerability Assessment System (OpenVAS)
-Requires=apache2.service
-After=apache2.service
-
-[Service]
-User=root
-RemainAfterExit=yes
-ExecStart=$PWN_ROOT/packer/daemons/openvas.rb --action start
-ExecReload=$PWN_ROOT/packer/daemons/openvas.rb --action restart
-ExecStop=$PWN_ROOT/packer/daemons/openvas.rb --action stop
-
-[Install]
-WantedBy=multi-user.target

data/etc/userland/aws/apache2/jenkins_443.conf

@@ -1,90 +0,0 @@
-<IfModule mod_ssl.c>
-  <VirtualHost *:443>
-    ServerAdmin root@localhost.internal
-    ServerName jenkins.DOMAIN
-
-    ErrorLog ${APACHE_LOG_DIR}/error.log
-    CustomLog ${APACHE_LOG_DIR}/access.log combined
-    ErrorDocument 503 "Sleeping for maintenance..."
- 
-    SSLEngine On
-    SSLProxyEngine On
-    SSLCertificateFile /etc/letsencrypt/live/jenkins.DOMAIN/fullchain.pem
-    SSLCertificateKeyFile /etc/letsencrypt/live/jenkins.DOMAIN/privkey.pem
-    Include /etc/letsencrypt/options-ssl-apache.conf
- 
-    ProxyRequests     Off
-    ProxyPreserveHost On
-    ProxyPass         / http://127.0.0.1:8888/ nocanon
-    ProxyPassReverse  / http://127.0.0.1:8888/
-    ProxyPassReverse  / http://jenkins.DOMAIN/
-    AllowEncodedSlashes NoDecode
-    ProxyPreserveHost on
-    RequestHeader set X-Forwarded-Proto "https"
-    RequestHeader set X-Forwarded-Port "443"
-    <Proxy http://127.0.0.1:8888/*>
-      Order allow,deny
-      Allow from all
-    </Proxy>
-    #RewriteEngine On
-    #RewriteCond %{HTTP_COOKIE} (JSESSIONID.[a-z0-9]+)
-    #RewriteRule ^/?logout$ https://SSO.onelogin.com/trust/saml2/http-redirect/slo/519926 [R,CO=%1:LOGGED_OUT:;]
-  </VirtualHost>
-  # TLS Hardening
-  #
-  # Pseudo Random Number Generator (PRNG):
-  # Configure one or more sources to seed the PRNG of the SSL library.
-  # The seed data should be of good random quality.
-  # WARNING! On some platforms /dev/random blocks if not enough entropy
-  # is available. This means you then cannot use the /dev/random device
-  # because it would lead to very long connection times (as long as
-  # it requires to make more entropy available). But usually those
-  # platforms additionally provide a /dev/urandom device which doesn't
-  # block. So, if available, use this one instead. Read the mod_ssl User
-  # Manual for more details.
-  #
-  SSLRandomSeed startup builtin
-  SSLRandomSeed startup file:/dev/urandom 512
-  SSLRandomSeed connect builtin
-  SSLRandomSeed connect file:/dev/urandom 512
-
-  ##
-  ##  SSL Global Context
-  ##
-  ##  All SSL configuration in this context applies both to
-  ##  the main server and all SSL-enabled virtual hosts.
-  ##
-  #
-  #   Some MIME-types for downloading Certificates and CRLs
-  #
-  AddType application/x-x509-ca-cert .crt
-  AddType application/x-pkcs7-crl    .crl
-
-  #   Pass Phrase Dialog:
-  #   Configure the pass phrase gathering process.
-  #   The filtering dialog program (`builtin' is a internal
-  #   terminal dialog) has to provide the pass phrase on stdout.
-  SSLPassPhraseDialog  builtin
-
-  #   Inter-Process Session Cache:
-  #   Configure the SSL Session Cache: First the mechanism 
-  #   to use and second the expiring timeout (in seconds).
-  #SSLSessionCache         dbm:/var/run/apache2/ssl_scache
-  SSLSessionCache        shmcb:/var/cache/mod_ssl/scache(512000)
-  SSLSessionCacheTimeout  300
-
-  #   SSL Cipher Suite:
-  #   List the ciphers that the client is permitted to negotiate.
-  #   See the mod_ssl documentation for a complete list.
-  #   enable only secure ciphers:
-  SSLCipherSuite  ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA
-  SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
-
-  SSLHonorCipherOrder On
-  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
-  Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
-  Header always set X-Frame-Options SAMEORIGIN
-  Header set Cache-Control "no-cache, no-store, must-revalidate"
-  Header set Pragma "no-cache"
-  Header set Expires 0
-</IfModule>

data/etc/userland/aws/apache2/jenkins_80.conf

@@ -1,7 +0,0 @@
-<VirtualHost *:80>
-  ServerName jenkins.DOMAIN
- 
-  RewriteEngine on
-  ReWriteCond %{SERVER_PORT} !^443$
-  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]
-</VirtualHost>

data/etc/userland/aws/apache2/openvas_443.conf

@@ -1,87 +0,0 @@
-<IfModule mod_ssl.c>
-  <VirtualHost *:443>
-    ServerAdmin root@localhost.internal
-    ServerName openvas.DOMAIN
-
-    ErrorLog ${APACHE_LOG_DIR}/error.log
-    CustomLog ${APACHE_LOG_DIR}/access.log combined
-    ErrorDocument 503 "Sleeping for maintenance..."
- 
-    SSLEngine On
-    SSLProxyEngine On
-    SSLCertificateFile /etc/letsencrypt/live/jenkins.DOMAIN/fullchain.pem
-    SSLCertificateKeyFile /etc/letsencrypt/live/jenkins.DOMAIN/privkey.pem
-    Include /etc/letsencrypt/options-ssl-apache.conf
- 
-    ProxyRequests     Off
-    ProxyPreserveHost On
-    ProxyPass         / http://127.0.0.1:9392/ nocanon
-    ProxyPassReverse  / http://127.0.0.1:9392/
-    ProxyPassReverse  / http://openvas.DOMAIN/
-    AllowEncodedSlashes NoDecode
-    ProxyPreserveHost on
-    RequestHeader set X-Forwarded-Proto "https"
-    RequestHeader set X-Forwarded-Port "443"
-    <Proxy http://127.0.0.1:9392/*>
-      Order allow,deny
-      Allow from all
-    </Proxy>
-  </VirtualHost>
-  # TLS Hardening
-  #
-  # Pseudo Random Number Generator (PRNG):
-  # Configure one or more sources to seed the PRNG of the SSL library.
-  # The seed data should be of good random quality.
-  # WARNING! On some platforms /dev/random blocks if not enough entropy
-  # is available. This means you then cannot use the /dev/random device
-  # because it would lead to very long connection times (as long as
-  # it requires to make more entropy available). But usually those
-  # platforms additionally provide a /dev/urandom device which doesn't
-  # block. So, if available, use this one instead. Read the mod_ssl User
-  # Manual for more details.
-  #
-  SSLRandomSeed startup builtin
-  SSLRandomSeed startup file:/dev/urandom 512
-  SSLRandomSeed connect builtin
-  SSLRandomSeed connect file:/dev/urandom 512
-
-  ##
-  ##  SSL Global Context
-  ##
-  ##  All SSL configuration in this context applies both to
-  ##  the main server and all SSL-enabled virtual hosts.
-  ##
-  #
-  #   Some MIME-types for downloading Certificates and CRLs
-  #
-  AddType application/x-x509-ca-cert .crt
-  AddType application/x-pkcs7-crl    .crl
-
-  #   Pass Phrase Dialog:
-  #   Configure the pass phrase gathering process.
-  #   The filtering dialog program (`builtin' is a internal
-  #   terminal dialog) has to provide the pass phrase on stdout.
-  SSLPassPhraseDialog  builtin
-
-  #   Inter-Process Session Cache:
-  #   Configure the SSL Session Cache: First the mechanism 
-  #   to use and second the expiring timeout (in seconds).
-  #SSLSessionCache         dbm:/var/run/apache2/ssl_scache
-  SSLSessionCache        shmcb:/var/cache/mod_ssl/scache(512000)
-  SSLSessionCacheTimeout  300
-
-  #   SSL Cipher Suite:
-  #   List the ciphers that the client is permitted to negotiate.
-  #   See the mod_ssl documentation for a complete list.
-  #   enable only secure ciphers:
-  SSLCipherSuite  ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA
-  SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
-
-  SSLHonorCipherOrder On
-  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
-  Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
-  Header always set X-Frame-Options SAMEORIGIN
-  Header set Cache-Control "no-cache, no-store, must-revalidate"
-  Header set Pragma "no-cache"
-  Header set Expires 0
-</IfModule>

data/etc/userland/aws/apache2/openvas_80.conf

@@ -1,7 +0,0 @@
-<VirtualHost *:80>
-  ServerName openvas.DOMAIN
- 
-  RewriteEngine on
-  ReWriteCond %{SERVER_PORT} !^443$
-  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]
-</VirtualHost>