@cdxgen/cdxgen 0.0.1 → 13.0.1

package/data/cbomosdb-queries.json

@@ -0,0 +1,68 @@
+{
+  "deb_packages": {
+    "query": "select * from deb_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Retrieves all the installed DEB packages in the target Linux system.",
+    "purlType": "deb",
+    "componentType": "library"
+  },
+  "portage_packages": {
+    "query": "select * from portage_packages where package like '%ssl%' OR package like '%crypto%';",
+    "description": "Retrieves all the installed packages on the target Linux system.",
+    "purlType": "ebuild",
+    "componentType": "library"
+  },
+  "rpm_packages": {
+    "query": "select * from rpm_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Retrieves all the installed RPM packages in the target Linux system.",
+    "purlType": "rpm",
+    "componentType": "library"
+  },
+  "python_packages": {
+    "query": "select * from python_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Python packages installed on system.",
+    "purlType": "pypi",
+    "componentType": "library"
+  },
+  "windows_programs": {
+    "query": "select * from programs where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Retrieves the list of products as they are installed by Windows Installer in the target Windows system.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "homebrew_packages": {
+    "query": "SELECT * FROM homebrew_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "List all homebrew_packages.",
+    "purlType": "swid",
+    "componentType": "library"
+  },
+  "authorized_keys": {
+    "query": "SELECT * FROM authorized_keys;",
+    "description": "List of authorized keys.",
+    "purlType": "generic",
+    "componentType": "cryptographic-asset"
+  },
+  "certificates": {
+    "query": "SELECT * FROM certificates;",
+    "description": "List of certificates.",
+    "purlType": "generic",
+    "componentType": "cryptographic-asset"
+  },
+  "keychain_items": {
+    "query": "SELECT * FROM keychain_items;",
+    "description": "Generic details about keychain items.",
+    "purlType": "generic",
+    "componentType": "data"
+  },
+  "kernel_keys": {
+    "query": "SELECT * FROM kernel_keys;",
+    "description": "List of security data, authentication keys and encryption keys.",
+    "purlType": "generic",
+    "componentType": "cryptographic-asset"
+  },
+  "yum_sources": {
+    "query": "SELECT * FROM yum_sources;",
+    "description": "Current list of Yum repositories or software channels.",
+    "purlType": "generic",
+    "componentType": "data"
+  }
+}

package/data/component-tags.json

@@ -0,0 +1,339 @@
+{
+  "description": {
+    "all": [
+      "sql",
+      "xml",
+      "web",
+      "security",
+      "database",
+      "json",
+      "yaml",
+      "validation",
+      "sanitization",
+      "cloud",
+      "iam",
+      "auth",
+      "middleware",
+      "serialization",
+      "event",
+      "stream",
+      "rpc",
+      "socket",
+      "proto",
+      "resource",
+      "sensitive",
+      "template",
+      "log",
+      "logging",
+      "service",
+      "api",
+      "slf4j",
+      "parse",
+      "emit",
+      "jdbc",
+      "connect",
+      "pool",
+      "beans",
+      "transaction",
+      "mysql",
+      "postgres",
+      "oracle",
+      "mongo",
+      "redis",
+      "splunk",
+      "stripe",
+      "payment",
+      "finance",
+      "currency",
+      "coin",
+      "monero",
+      "ssl",
+      "traffic",
+      "mvc",
+      "html",
+      "escape",
+      "unescape",
+      "rest",
+      "tomcat",
+      "hibernate",
+      "orm",
+      "aop",
+      "jwt",
+      "saml",
+      "token",
+      "tls",
+      "codec",
+      "cron",
+      "crypto",
+      "jce",
+      "certificate",
+      "developer",
+      "tools",
+      "autoconfigure",
+      "test",
+      "jsonpath",
+      "bytecode",
+      "mock",
+      "injection",
+      "comparators",
+      "transform",
+      "encode",
+      "decode",
+      "ldap",
+      "owasp",
+      "fileupload",
+      "beanshell",
+      "spel",
+      "mail",
+      "apacheds",
+      "jndi",
+      "ldif",
+      "jdbm",
+      "kerberos",
+      "oidc",
+      "oauth2",
+      "cli",
+      "binary",
+      "ml",
+      "ai",
+      "azure",
+      "gcp",
+      "terraform",
+      "redis",
+      "valkey",
+      "lint",
+      "bundle",
+      "object-persistence",
+      "text-to-image",
+      "translat",
+      "object-detect",
+      "mvc",
+      "framework",
+      "graph",
+      "templates",
+      "fastjson",
+      "simd",
+      "event-driven",
+      "productivity",
+      "typesafe",
+      "projections",
+      "performance",
+      "plugins",
+      "non-block"
+    ]
+  },
+  "properties": {
+    "all": [
+      "sql",
+      "xml",
+      "cloud",
+      "middleware",
+      "framework",
+      "bluetooth",
+      "wifi",
+      "wireless",
+      "driver",
+      "graphics",
+      "firmware",
+      "gyroscope",
+      "accelerometer",
+      "mobile",
+      "network",
+      "battery",
+      "matrix",
+      "thunderbolt",
+      "crypto",
+      "algorithm",
+      "encrypt",
+      "decrypt",
+      "payment",
+      "stripe",
+      "apple-pay",
+      "icloud"
+    ],
+    "obom": [
+      "windows_drivers",
+      "windows_patches",
+      "windows_programs",
+      "processor",
+      "services_snapshot",
+      "apt_sources",
+      "apt_ppa_sources",
+      "behavioral_reverse_shell",
+      "certificates",
+      "chrome_extensions",
+      "crontab_snapshot",
+      "deb_packages",
+      "docker_container_ports",
+      "docker_containers",
+      "docker_networks",
+      "docker_volumes",
+      "etc_hosts",
+      "firefox_addons",
+      "gatekeeper",
+      "vscode_extensions",
+      "homebrew_packages",
+      "installed_applications",
+      "interface_addresses",
+      "kernel_info",
+      "kernel_integrity",
+      "kernel_modules",
+      "ld_preload",
+      "listening_ports",
+      "os_version",
+      "pipes",
+      "pipes_snapshot",
+      "portage_packages",
+      "process_events",
+      "secureboot_certificates",
+      "processes",
+      "python_packages",
+      "npm_packages",
+      "rpm_packages",
+      "scheduled_tasks",
+      "services_snapshot",
+      "startup_items",
+      "system_info_snapshot",
+      "trusted_gpg_keys",
+      "windows_drivers",
+      "windows_patches",
+      "windows_programs",
+      "windows_shared_resources",
+      "yum_sources",
+      "appcompat_shims",
+      "browser_plugins",
+      "certificates",
+      "chocolatey_packages",
+      "chrome_extensions",
+      "etc_hosts",
+      "firefox_addons",
+      "ie_extensions",
+      "kernel_info",
+      "npm_packages",
+      "opera_extensions",
+      "pipes_snapshot",
+      "process_open_handles_snapshot",
+      "process_open_sockets",
+      "safari_extensions",
+      "scheduled_tasks",
+      "services_snapshot",
+      "startup_items",
+      "routes",
+      "system_info_snapshot",
+      "win_version",
+      "windows_firewall_rules",
+      "windows_optional_features",
+      "windows_programs",
+      "windows_shared_resources",
+      "windows_update_history",
+      "wmi_cli_event_consumers",
+      "wmi_cli_event_consumers_snapshot",
+      "wmi_event_filters",
+      "wmi_filter_consumer_binding"
+    ]
+  },
+  "name": {
+    "sbom": [
+      {
+        "test": [
+          "(junit|xmlunit|testng|mocha|istanbul|expect|jest|test4j|xunit|coverlet|Test\\.Sdk|Moq)",
+          "^(chai)$"
+        ]
+      },
+      {
+        "security": [
+          "(boringssl|openssl|libressl|libssl|gnutls|jose|keyutils|Azure\\.Security|System\\.Security)"
+        ]
+      },
+      { "native": ["(ffi|native)"] },
+      { "parse": ["(parser)"] },
+      { "transform": ["(transformer)"] },
+      { "telemetry": ["(OpenTelemetry)"] },
+      { "logging": ["(Microsoft\\.Extensions\\.Logging|Log4net)"] },
+      { "ml": ["^(llama|langchain|openai)", "(generativeai)"] },
+      { "devel": ["^(types-|typing-|virtualenv|ruff|poetry)"] }
+    ],
+    "obom": [
+      {
+        "devel": [
+          "-(dev|devel|headers|sdk|libs|extension|headers+x86|headers+x64|headers+arm64)$",
+          "^(git)[-]?",
+          "^(sdk|windows+sdk)"
+        ]
+      },
+      {
+        "bin": [
+          "(-bin|redistributable|clickonce|bootstrappermsi|bootstrappermsires|clickoncesigntoolmsi|codecoveragemsi|msires|sharedmsi|x64msi|arm64msi|sharedmsi|x64vmsi|filehandler_amd64|filehandler_x86|protocolhandlermsi|interopmsi|interopx64msi|shellmsires|shellx64msi)$"
+        ]
+      },
+      { "kernel": ["^(linux|kernel|os-image)"] },
+      {
+        "security": [
+          "(selinux|apparmor|security|boringssl|openssl|libressl|gnutls|jose|keyutils|passwd|libssl|libaudit|gcrypt|libpam|libseccomp)"
+        ]
+      },
+      {
+        "container": [
+          "(container|podman|docker|runc|nerdctl|crun|libvirt|qemu)"
+        ]
+      },
+      {
+        "build": [
+          "(cpp|fortran|gcc|make|meson|bazel|maven|gradle|sbt|ant|gdb|boost|compiler|kotlin|cargo|rustc|llvm|libstdc)"
+        ]
+      },
+      {
+        "network": [
+          "(tailscale|wireguard|openvpn|dns|cockpit|cups|dhcp|network|iproute|iptables|mosh|netavark|openssh|rsync|tcpdump|libssh)"
+        ]
+      },
+      { "webserver": ["(httpd|http2|tomcat|jboss)"] },
+      {
+        "crypto": [
+          "(crypt|gpg|keys|certificates|gnupg|certifi|pubkey|keyutils|nss|keyring)"
+        ]
+      },
+      { "repository": ["(-repos|-release|ostree|appstream)"] },
+      { "shell": ["(bash|zsh|csh|fish|binsh|dash|oilsh)"] },
+      { "bluetooth": ["(bluez|bluetooth)"] },
+      { "sound": ["(alsa|pulseaudio|wireplumber|flac|codecs|ldac|sound)"] },
+      {
+        "compression": [
+          "(brotli|xz-utils|zstd|lz4|zlib|bz2|lzma5|bzip2|libarchive)",
+          "(tar|zip|webp|zchunk)$"
+        ]
+      },
+      {
+        "runtime": [
+          "(perl|lua|php|python|ruby|dotnet|java|swift|runtime|glibc|libc6|musl|wasm|\\.net|asp\\.net|node.js|node|groovy)"
+        ]
+      },
+      { "editor": ["(vim|emacs|nano|hexedit)"] },
+      { "xml": ["(xml|expat)"] },
+      { "boot": ["(grub|systemd-boot|syslinux|init-system|sysvinit)"] },
+      {
+        "gui": [
+          "(wayland|xorg|X11|mesa|vulkan|tk|wkhtmltox|electron|Xrender|glib2)"
+        ]
+      },
+      {
+        "package": [
+          "(rpm|dnf|yum|apt|zypper|apk|conda|dpkg|dnf5)$",
+          "^(conda_package_|conda-package-|libapt|dnf5-|libdnf5)"
+        ]
+      },
+      {
+        "browser": [
+          "^(edge)",
+          "^(firefox|chrome|opera|brave|mullvad|tor|chromium)",
+          "^(microsoft+edge|microsoft+edge+webview2|microsoft+html)"
+        ]
+      },
+      {
+        "chat": ["(webex|teams|slack|discord|vesktop|matrix|signal|whatsapp)"]
+      },
+      { "logging": ["(log4j|logging|slf4j)"] },
+      { "root": ["^(sudo|systemd|pam|shadow)$"] }
+    ]
+  }
+}

package/data/container-knowledge-index.json

@@ -0,0 +1,125 @@
+{
+  "entries": {
+    "cdk": {
+      "attackTactics": ["TA0003", "TA0004", "TA0006", "TA0007", "TA0008"],
+      "attackTechniques": ["T1552.007", "T1609", "T1611", "T1613"],
+      "offenseTools": ["cdk"],
+      "riskTags": [
+        "container-escape",
+        "credential-access",
+        "k8s-cluster-pivot",
+        "offensive-toolkit"
+      ],
+      "sourceKeys": ["attack-containers", "cdk"]
+    },
+    "ctr": {
+      "attackTactics": ["TA0004", "TA0008"],
+      "attackTechniques": ["T1611"],
+      "offenseTools": ["cdk"],
+      "riskTags": ["container-escape", "runtime-control"],
+      "sourceKeys": ["attack-containers", "cdk"]
+    },
+    "curl": {
+      "attackTactics": ["TA0010", "TA0011"],
+      "attackTechniques": ["T1041", "T1105"],
+      "offenseTools": ["cdk", "deepce"],
+      "riskTags": ["data-exfiltration", "payload-delivery"],
+      "sourceKeys": ["cdk", "deepce"]
+    },
+    "deepce": {
+      "attackTactics": ["TA0004", "TA0006", "TA0007", "TA0008"],
+      "attackTechniques": ["T1552.007", "T1611", "T1613"],
+      "offenseTools": ["deepce"],
+      "riskTags": [
+        "container-escape",
+        "credential-access",
+        "offensive-toolkit"
+      ],
+      "sourceKeys": ["attack-containers", "deepce"]
+    },
+    "docker": {
+      "attackTactics": ["TA0004", "TA0008"],
+      "attackTechniques": ["T1611"],
+      "offenseTools": ["cdk", "deepce"],
+      "riskTags": ["container-escape", "runtime-socket"],
+      "sourceKeys": ["attack-containers", "cdk", "deepce"]
+    },
+    "kubectl": {
+      "attackTactics": ["TA0006", "TA0007", "TA0008"],
+      "attackTechniques": ["T1552.007", "T1609", "T1613"],
+      "offenseTools": ["cdk", "peirates"],
+      "riskTags": [
+        "credential-access",
+        "k8s-cluster-pivot",
+        "serviceaccount-access"
+      ],
+      "sourceKeys": ["attack-containers", "cdk", "peirates"]
+    },
+    "nc": {
+      "attackTactics": ["TA0008", "TA0011"],
+      "attackTechniques": ["T1041", "T1105"],
+      "offenseTools": ["cdk", "deepce"],
+      "riskTags": ["payload-delivery", "remote-shell"],
+      "sourceKeys": ["cdk", "deepce"]
+    },
+    "nsenter": {
+      "attackTactics": ["TA0004", "TA0008"],
+      "attackTechniques": ["T1611"],
+      "offenseTools": ["cdk", "deepce"],
+      "riskTags": ["container-escape", "namespace-escape"],
+      "seccompBlockedSyscalls": ["ptrace", "setns", "unshare"],
+      "seccompProfile": "docker-default",
+      "sourceKeys": ["attack-containers", "cdk", "deepce", "docker-seccomp"]
+    },
+    "peirates": {
+      "attackTactics": ["TA0003", "TA0006", "TA0007", "TA0008"],
+      "attackTechniques": ["T1552.007", "T1609", "T1613"],
+      "offenseTools": ["peirates"],
+      "riskTags": [
+        "credential-access",
+        "k8s-cluster-pivot",
+        "offensive-toolkit"
+      ],
+      "sourceKeys": ["attack-containers", "peirates"]
+    },
+    "runc": {
+      "attackTactics": ["TA0004", "TA0008"],
+      "attackTechniques": ["T1611"],
+      "offenseTools": ["cdk"],
+      "riskTags": ["container-escape", "runtime-control"],
+      "seccompBlockedSyscalls": ["open_by_handle_at", "setns"],
+      "seccompProfile": "docker-default",
+      "sourceKeys": ["attack-containers", "cdk", "docker-seccomp"]
+    },
+    "socat": {
+      "attackTactics": ["TA0008", "TA0011"],
+      "attackTechniques": ["T1041", "T1105"],
+      "offenseTools": ["cdk", "deepce"],
+      "riskTags": ["payload-delivery", "remote-shell"],
+      "sourceKeys": ["cdk", "deepce"]
+    },
+    "unshare": {
+      "attackTactics": ["TA0004", "TA0008"],
+      "attackTechniques": ["T1611"],
+      "offenseTools": ["cdk"],
+      "riskTags": ["container-escape", "namespace-escape"],
+      "seccompBlockedSyscalls": ["clone", "unshare"],
+      "seccompProfile": "docker-default",
+      "sourceKeys": ["attack-containers", "cdk", "docker-seccomp"]
+    },
+    "wget": {
+      "attackTactics": ["TA0010", "TA0011"],
+      "attackTechniques": ["T1041", "T1105"],
+      "offenseTools": ["cdk", "deepce"],
+      "riskTags": ["data-exfiltration", "payload-delivery"],
+      "sourceKeys": ["cdk", "deepce"]
+    }
+  },
+  "sources": {
+    "attack-containers": "https://attack.mitre.org/matrices/enterprise/containers/",
+    "cdk": "https://github.com/cdk-team/CDK",
+    "deepce": "https://github.com/stealthcopter/deepce",
+    "docker-seccomp": "https://docs.docker.com/engine/security/seccomp/",
+    "peirates": "https://github.com/inguardians/peirates"
+  }
+}

package/data/cosdb-queries.json

@@ -0,0 +1,17 @@
+{
+  "deb_packages": {
+    "query": "select * from deb_packages where name like '%dev%' OR name like '%header%';",
+    "description": "Retrieves all the installed DEB packages in the target Linux system.",
+    "purlType": "deb"
+  },
+  "portage_packages": {
+    "query": "select * from portage_packages where package like '%dev%' OR package like '%header%';",
+    "description": "Retrieves all the installed packages on the target Linux system.",
+    "purlType": "ebuild"
+  },
+  "rpm_packages": {
+    "query": "select * from rpm_packages where name like '%dev%' OR name like '%header%';",
+    "description": "Retrieves all the installed RPM packages in the target Linux system.",
+    "purlType": "rpm"
+  }
+}