opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/vulnerability-scanning/SKILL.md

@@ -0,0 +1,448 @@
+---
+name: vulnerability-scanning
+description: Scan systems and dependencies for CVEs and security vulnerabilities.
+category: security
+risk: offensive
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant security tooling (scanners, vault CLIs) and an
+  authorized scope for any active assessment. Docs-only; helper scripts and templates
+  not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+> **⚠️ AUTHORIZED USE ONLY**
+> This skill is for educational purposes or authorized security assessments only.
+> You must have explicit, written permission from the system owner before using this tool.
+> Misuse of this tool is illegal and strictly prohibited.
+
+> **Mandatory confirmation gate**
+> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
+> 1. Ask the user to state the exact target URL, IP, account, or resource.
+> 2. Ask the user to confirm written authorization and the permitted scope.
+> 3. Show the exact command(s) and explain their expected effect.
+> 4. Wait for explicit confirmation in the current conversation.
+>
+> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
+
+# Vulnerability Scanning
+
+Identify and prioritize security vulnerabilities across infrastructure and applications.
+
+## When to Use This Skill
+
+Use this skill when:
+- Performing security assessments
+- Implementing vulnerability management programs
+- Meeting compliance requirements
+- Triaging and prioritizing remediation
+- Scanning infrastructure for known CVEs
+
+## Prerequisites
+
+- Access to scanning tools
+- Network access to targets
+- Appropriate authorization
+
+## Vulnerability Scanning Tools
+
+| Tool | Type | Best For |
+|------|------|----------|
+| Nessus | Commercial | Enterprise scanning |
+| OpenVAS | Open Source | Free alternative |
+| Qualys | Cloud SaaS | Large scale |
+| Nexpose/InsightVM | Commercial | Asset management |
+| Nuclei | Open Source | Template-based |
+
+## OpenVAS Setup
+
+### Docker Deployment
+
+```bash
+# Run OpenVAS container
+docker run -d --name openvas \
+  -p 443:443 \
+  -v openvas-data:/data \
+  greenbone/openvas-scanner
+
+# Access web UI at https://localhost
+# Default credentials: admin/admin
+```
+
+### Scanning Commands
+
+```bash
+# Create target
+omp -u admin -w admin --xml='<create_target>
+  <name>Web Servers</name>
+  <hosts>192.168.1.0/24</hosts>
+</create_target>'
+
+# Create task
+omp -u admin -w admin --xml='<create_task>
+  <name>Weekly Scan</name>
+  <target id="target-uuid"/>
+  <config id="daba56c8-73ec-11df-a475-002264764cea"/>
+</create_task>'
+
+# Start task
+omp -u admin -w admin --xml='<start_task task_id="task-uuid"/>'
+
+# Get results
+omp -u admin -w admin --xml='<get_results task_id="task-uuid"/>'
+```
+
+## Nessus
+
+### API Usage
+
+```python
+import requests
+
+class NessusScanner:
+    def __init__(self, url, access_key, secret_key):
+        self.url = url
+        self.headers = {
+            'X-ApiKeys': f'accessKey={access_key}; secretKey={secret_key}',
+            'Content-Type': 'application/json'
+        }
+    
+    def create_scan(self, name, targets, template='basic'):
+        """Create a new scan."""
+        templates = self.get('/editor/scan/templates')
+        template_uuid = next(
+            t['uuid'] for t in templates['templates'] 
+            if t['name'] == template
+        )
+        
+        payload = {
+            'uuid': template_uuid,
+            'settings': {
+                'name': name,
+                'text_targets': targets,
+                'enabled': True
+            }
+        }
+        return self.post('/scans', payload)
+    
+    def launch_scan(self, scan_id):
+        """Start a scan."""
+        return self.post(f'/scans/{scan_id}/launch')
+    
+    def get_results(self, scan_id):
+        """Get scan results."""
+        return self.get(f'/scans/{scan_id}')
+    
+    def export_report(self, scan_id, format='pdf'):
+        """Export scan report."""
+        payload = {'format': format}
+        response = self.post(f'/scans/{scan_id}/export', payload)
+        file_id = response['file']
+        
+        # Wait for export
+        while True:
+            status = self.get(f'/scans/{scan_id}/export/{file_id}/status')
+            if status['status'] == 'ready':
+                break
+            time.sleep(5)
+        
+        return self.get(f'/scans/{scan_id}/export/{file_id}/download')
+    
+    def get(self, path):
+        response = requests.get(f'{self.url}{path}', headers=self.headers, verify=False)
+        return response.json()
+    
+    def post(self, path, data=None):
+        response = requests.post(f'{self.url}{path}', json=data, headers=self.headers, verify=False)
+        return response.json()
+
+# Usage
+scanner = NessusScanner('https://nessus:8834', 'access-key', 'secret-key')
+scan = scanner.create_scan('Weekly Infrastructure Scan', '10.0.0.0/24')
+scanner.launch_scan(scan['scan']['id'])
+```
+
+## Nuclei
+
+### Installation
+
+```bash
+# Install nuclei
+go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+
+# Or download binary
+wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip
+unzip nuclei_linux_amd64.zip
+```
+
+### Basic Scanning
+
+```bash
+# Update templates
+nuclei -update-templates
+
+# Scan single target
+nuclei -u https://example.com
+
+# Scan multiple targets
+nuclei -l targets.txt
+
+# Scan with specific templates
+nuclei -u https://example.com -t cves/
+nuclei -u https://example.com -t vulnerabilities/
+
+# Scan with severity filter
+nuclei -u https://example.com -s critical,high
+
+# Output formats
+nuclei -u https://example.com -o results.txt
+nuclei -u https://example.com -json -o results.json
+```
+
+### Custom Templates
+
+```yaml
+# custom-check.yaml
+id: custom-admin-panel
+
+info:
+  name: Admin Panel Detection
+  author: security-team
+  severity: info
+  tags: recon,panel
+
+requests:
+  - method: GET
+    path:
+      - "{{BaseURL}}/admin"
+      - "{{BaseURL}}/administrator"
+      - "{{BaseURL}}/wp-admin"
+    
+    matchers-condition: or
+    matchers:
+      - type: word
+        words:
+          - "admin"
+          - "login"
+        condition: and
+      
+      - type: status
+        status:
+          - 200
+          - 301
+          - 302
+```
+
+## CVSS Scoring
+
+### Severity Levels
+
+| Score | Rating | Response Time |
+|-------|--------|---------------|
+| 9.0-10.0 | Critical | 24 hours |
+| 7.0-8.9 | High | 7 days |
+| 4.0-6.9 | Medium | 30 days |
+| 0.1-3.9 | Low | 90 days |
+
+### Prioritization Factors
+
+```yaml
+prioritization_criteria:
+  critical_factors:
+    - Internet-facing systems
+    - Systems with sensitive data
+    - Active exploitation in the wild
+    - Authentication bypass
+    
+  high_factors:
+    - Remote code execution
+    - Privilege escalation
+    - Data exfiltration risk
+    
+  context_adjustments:
+    - Compensating controls in place (-1)
+    - No direct exposure (-1)
+    - Critical business system (+1)
+    - Compliance requirement (+1)
+```
+
+## Vulnerability Management Process
+
+### Workflow
+
+```yaml
+vulnerability_workflow:
+  discovery:
+    - Run scheduled scans
+    - Import third-party findings
+    - Correlate with asset inventory
+    
+  analysis:
+    - Validate findings
+    - Remove false positives
+    - Assess business impact
+    - Prioritize by risk score
+    
+  remediation:
+    - Assign to owners
+    - Track SLA compliance
+    - Verify fixes
+    - Document exceptions
+    
+  reporting:
+    - Executive summaries
+    - Technical details
+    - Trend analysis
+    - Compliance metrics
+```
+
+### Tracking Template
+
+```markdown
+## Vulnerability Ticket
+
+**ID:** VULN-2024-001
+**CVE:** CVE-2024-12345
+**CVSS:** 9.8 (Critical)
+**Affected System:** web-server-01
+
+### Description
+Remote code execution vulnerability in Apache Struts.
+
+### Impact
+Attacker can execute arbitrary code on the server.
+
+### Remediation
+1. Update Apache Struts to version 2.5.33
+2. Apply WAF rule as temporary mitigation
+
+### Timeline
+- Discovered: 2024-01-15
+- SLA Due: 2024-01-16
+- Remediated: 2024-01-15
+
+### Evidence
+- Scan report: [link]
+- Screenshot: [link]
+```
+
+## CI/CD Integration
+
+### GitHub Actions
+
+```yaml
+name: Vulnerability Scan
+
+on:
+  schedule:
+    - cron: '0 2 * * *'
+  push:
+    branches: [main]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Nuclei
+        uses: projectdiscovery/nuclei-action@main
+        with:
+          target: https://example.com
+          templates: cves/
+          output: nuclei-results.txt
+
+      - name: Check for critical findings
+        run: |
+          if grep -q "critical" nuclei-results.txt; then
+            echo "Critical vulnerabilities found!"
+            exit 1
+          fi
+
+      - name: Upload results
+        uses: actions/upload-artifact@v4
+        with:
+          name: vulnerability-report
+          path: nuclei-results.txt
+```
+
+## Compliance Scanning
+
+### CIS Benchmark Scan
+
+```bash
+# Using OpenSCAP
+oscap xccdf eval \
+  --profile xccdf_org.ssgproject.content_profile_cis \
+  --results results.xml \
+  --report report.html \
+  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
+```
+
+### PCI DSS Scanning
+
+```yaml
+pci_scan_requirements:
+  quarterly:
+    - External vulnerability scan (ASV)
+    - Internal vulnerability scan
+    
+  after_changes:
+    - Significant infrastructure changes
+    - New system deployments
+    
+  passing_criteria:
+    - No vulnerabilities rated 4.0+ (CVSS)
+    - False positives documented
+    - Scan completed within 90 days
+```
+
+## Common Issues
+
+### Issue: False Positives
+**Problem**: Scanner reports non-existent vulnerabilities
+**Solution**: Validate manually, tune scanner, maintain exception list
+
+### Issue: Incomplete Coverage
+**Problem**: Not all assets scanned
+**Solution**: Update asset inventory, verify credentials, check network access
+
+### Issue: Scan Impact
+**Problem**: Scans affecting production systems
+**Solution**: Schedule during maintenance windows, use authenticated scans
+
+## Best Practices
+
+- Maintain accurate asset inventory
+- Schedule regular scan cadence
+- Validate findings before remediation
+- Track metrics (MTTR, aging)
+- Integrate with ticketing systems
+- Document exceptions properly
+- Use risk-based prioritization
+- Automate where possible
+
+## Related Skills
+
+- sast-scanning (`sast-scanning`) - Code analysis
+- container-scanning (`container-scanning`) - Container security
+- cis-benchmarks (`cis-benchmarks`) - Compliance benchmarks
+
+## Limitations
+
+- Apply guidance only within authorized scope; test destructive steps in non-production first.
+- Docs-only import: upstream scripts and templates not bundled.
+
+### Example
+
+```bash
+# Read-only first: inventory before any active step.
+which <tool> && <tool> --help | head -n 20
+```
+
+> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.