attackmap-analyzer-iac 0.2.0__py3-none-any.whl

attackmap_analyzer_iac/records.py

@@ -0,0 +1,235 @@
+"""Misconfiguration records (iac#1).
+
+Container and cluster misconfigurations go to core's `CloudMisconfig` record
+(AttackMap#334), which core turns into findings with CWE/OWASP ids. They used
+to be `AuthHint`s, which core reads as recon: an `AuthHint` in a Dockerfile
+even counted as an auth control for the `EXPOSE` route next to it.
+
+With a core that predates `CloudMisconfig` (feature-detected: the SDK doesn't
+export it, or `ScanResult` has no `cloud_misconfigs`), the legacy `AuthHint`
+(if the check had one) is emitted instead. The `gha_*` / `shell_*` posture
+hints are `FrameworkHint`s on every core, old ones included: they were never
+auth signals and no core version consumes them by name.
+"""
+
+from __future__ import annotations
+
+from bisect import bisect_right
+
+from attackmap.sdk import AuthHint, ScanResult
+
+try:  # cores before 0.6 don't have the record; then no records are emitted
+    from attackmap.sdk import CloudMisconfig
+except ImportError:  # pragma: no cover - exercised against older cores
+    CloudMisconfig = None  # type: ignore[assignment,misc]
+
+_EVIDENCE_MAX = 200
+# Feature detection: an older core neither exports the record nor has the field.
+CLOUD_RECORDS = CloudMisconfig is not None and "cloud_misconfigs" in getattr(ScanResult, "model_fields", {})
+
+# Dedup keys per result, so appending stays O(1) on hostile input with
+# tens of thousands of signals (a linear `any(...)` scan per append is
+# quadratic). Keyed by id(); the result object is kept to rule out reuse.
+_SEEN: dict[int, tuple[object, set]] = {}
+
+
+def first_seen(owner: object, key: tuple) -> bool:
+    """True the first time ``key`` is offered for ``owner`` (a result, or a
+    hint list of one)."""
+    entry = _SEEN.get(id(owner))
+    if entry is None or entry[0] is not owner:
+        entry = _SEEN[id(owner)] = (owner, set())
+    if key in entry[1]:
+        return False
+    entry[1].add(key)
+    return True
+
+
+# Line starts of the file being analyzed: `line_of` / `line_snippet` from the
+# SDK rescan the text on every call, which is quadratic for a file with
+# tens of thousands of matches. Files are analyzed one at a time, so one
+# cached index is enough.
+_LINES: list = [None, [0]]
+
+
+def _starts(content: str) -> list[int]:
+    if _LINES[0] is not content:
+        starts = [0]
+        index = content.find("\n")
+        while index != -1:
+            starts.append(index + 1)
+            index = content.find("\n", index + 1)
+        _LINES[0], _LINES[1] = content, starts
+    return _LINES[1]
+
+
+def line_of(content: str, offset: int) -> int:
+    """1-indexed line of ``offset`` (same numbering as `attackmap.sdk.line_of`)."""
+    return bisect_right(_starts(content), max(offset, 0))
+
+
+def line_snippet(content: str, line: int, max_len: int = 200) -> str:
+    """Stripped text of 1-indexed ``line`` (as `attackmap.sdk.line_snippet`)."""
+    starts = _starts(content)
+    if line < 1 or line > len(starts):
+        return ""
+    end = starts[line] - 1 if line < len(starts) else len(content)
+    text = content[starts[line - 1]:end].strip()
+    return text if len(text) <= max_len else text[: max_len - 1] + "…"
+
+
+def release(*owners: object) -> None:
+    for owner in owners:
+        _SEEN.pop(id(owner), None)
+
+
+def append_misconfig(
+    result: ScanResult,
+    kind: str,
+    file: str,
+    line: int | None,
+    evidence: str,
+    *,
+    severity: str,
+    confidence: float = 0.8,
+    resource: str | None = None,
+    platform: str | None = None,
+    escalation: str | None = None,
+    context: str | None = None,
+    legacy_auth_hint: str | None = None,
+) -> None:
+    """One record per (kind, file, line, resource)."""
+    evidence = " ".join(evidence.split())
+    if len(evidence) > _EVIDENCE_MAX:
+        evidence = evidence[: _EVIDENCE_MAX - 1] + "…"
+    if not CLOUD_RECORDS:
+        if legacy_auth_hint and first_seen(result, ("auth", legacy_auth_hint, file)):
+            result.auth_hints.append(
+                AuthHint(hint=legacy_auth_hint, file=file, line=line, evidence_text=evidence, confidence=0.9)
+            )
+        return
+    if not first_seen(result, ("misconfig", kind, file, line, resource, evidence)):
+        return
+    result.cloud_misconfigs.append(
+        CloudMisconfig(
+            kind=kind, file=file, line=line, resource=resource, platform=platform, context=context,
+            escalation_path=escalation, evidence_text=evidence, severity=severity, confidence=confidence,
+        )
+    )
+
+
+# Linux capabilities that let a process break out of its container or take
+# over the node (high) or its network (medium). `CAP_` prefix stripped.
+DANGEROUS_CAPABILITIES = {
+    "ALL": "high",
+    "SYS_ADMIN": "high",
+    "SYS_MODULE": "high",
+    "SYS_PTRACE": "high",
+    "SYS_RAWIO": "high",
+    "DAC_READ_SEARCH": "high",
+    "BPF": "high",
+    "NET_ADMIN": "medium",
+    "SYS_TIME": "medium",
+}
+
+# Host paths whose mount hands a container the node: runtime sockets, the
+# root filesystem, kubelet state, kernel interfaces.
+_RUNTIME_SOCKETS = ("/var/run/docker.sock", "/run/docker.sock", "/var/run/containerd", "/run/containerd",
+                    "/var/run/crio", "/run/crio", "/var/run/cri-dockerd.sock")
+_SENSITIVE_HOST_PATHS = (*_RUNTIME_SOCKETS, "/etc", "/root", "/proc", "/sys", "/dev", "/boot",
+                         "/var/lib/kubelet", "/var/lib/docker", "/var/lib/containerd")
+
+
+# Read-only system data under the sensitive trees above: CA bundles, time
+# zone, the syslog socket.
+_BENIGN_HOST_PATHS = ("/etc/ssl", "/etc/pki", "/etc/ca-certificates", "/etc/localtime", "/etc/timezone",
+                      "/etc/machine-id", "/etc/os-release", "/etc/letsencrypt", "/dev/log", "/dev/dri",
+                      "/usr/share/ca-certificates")
+
+
+def _normalize(path: str) -> str:
+    path = path.strip().strip("'\"")
+    while "//" in path:
+        path = path.replace("//", "/")
+    return path.rstrip("/") or "/"
+
+
+def host_path_risk(path: str) -> tuple[str, str]:
+    """``(severity, escalation)`` for mounting host ``path``."""
+    norm = _normalize(path)
+    if any(norm == s or norm.startswith(s + "/") for s in _RUNTIME_SOCKETS):
+        return "high", "container runtime socket → start a privileged container → root on the node"
+    if norm == "/":
+        return "high", "host root filesystem → node root, kubelet credentials and every pod's secrets"
+    if any(norm == s or norm.startswith(s + "/") for s in _BENIGN_HOST_PATHS):
+        return "low", f"host {norm} is readable from the container"
+    if any(norm == s or norm.startswith(s + "/") for s in _SENSITIVE_HOST_PATHS):
+        return "high", f"host {norm} → node credentials or kernel interfaces → root on the node"
+    return "low", f"host {norm} is readable (and possibly writable) from the container"
+
+
+def capability_severity(cap: str) -> str | None:
+    return DANGEROUS_CAPABILITIES.get(cap.strip().strip("'\"").upper().removeprefix("CAP_"))
+
+
+# ---------- Kubernetes RBAC and Service exposure (shared by manifests) ----------
+
+# API groups whose objects are cluster control. A wildcard on a CRD group an
+# operator owns (`monitoring.coreos.com`) or on `metrics.k8s.io` is normal.
+SENSITIVE_API_GROUPS = frozenset({
+    "", "*", "apps", "batch", "extensions", "policy", "networking.k8s.io", "rbac.authorization.k8s.io",
+    "admissionregistration.k8s.io", "certificates.k8s.io", "apiextensions.k8s.io",
+})
+# Resources whose write (or read, for secrets) is a step toward cluster control.
+SENSITIVE_RESOURCES = frozenset({
+    "*", "secrets", "pods", "pods/exec", "pods/attach", "pods/ephemeralcontainers", "deployments", "daemonsets",
+    "statefulsets", "replicasets", "jobs", "cronjobs", "replicationcontrollers", "serviceaccounts",
+    "serviceaccounts/token", "roles", "rolebindings", "clusterroles", "clusterrolebindings", "nodes",
+    "nodes/proxy", "persistentvolumes", "mutatingwebhookconfigurations", "validatingwebhookconfigurations",
+    "customresourcedefinitions", "certificatesigningrequests", "certificatesigningrequests/approval",
+    "configmaps", "namespaces", "networkpolicies",
+})
+# Roles whose grant to every authenticated user is a takeover.
+ADMIN_LIKE_ROLES = frozenset({"cluster-admin", "admin", "edit"})
+
+
+def rbac_wildcard(groups: set[str] | None, verbs: set[str], resources: set[str]) -> bool:
+    """A `*` that matters: on a control-plane API group (``groups`` None
+    means the rule names none), and either every resource or a sensitive
+    one. `verbs: ["*"]` on `events` or `metrics.k8s.io` is not reported."""
+    if "*" not in verbs and "*" not in resources:
+        return False
+    if groups is not None and not groups & SENSITIVE_API_GROUPS:
+        return False
+    return "*" in resources or bool(resources & SENSITIVE_RESOURCES)
+
+
+# Annotation key suffix → values that make a LoadBalancer internal.
+_INTERNAL_LB_ANNOTATIONS = {
+    "aws-load-balancer-internal": {"true", "0.0.0.0/0"},
+    "aws-load-balancer-scheme": {"internal"},
+    "azure-load-balancer-internal": {"true"},
+    "oci-load-balancer-internal": {"true"},
+    "openstack-internal-load-balancer": {"true"},
+    "load-balancer-type": {"internal"},  # networking.gke.io/, cloud.google.com/
+    "ibm-load-balancer-cloud-provider-ip-type": {"private"},
+    "alibaba-cloud-loadbalancer-address-type": {"intranet"},
+}
+
+
+def internal_lb(annotations: dict[str, str]) -> bool:
+    """True when a cloud's internal-load-balancer annotation says so. An
+    explicit ``"false"`` / ``internet-facing`` is external; a templated
+    value (``__TPL__`` / ``${...}``) is unknown, so treated as internal
+    (not reported)."""
+    for key, value in annotations.items():
+        suffix = key.rsplit("/", 1)[-1].lower()
+        accepted = _INTERNAL_LB_ANNOTATIONS.get(suffix)
+        if accepted is None:
+            continue
+        text = value.strip().strip("\"'").lower()
+        if "__tpl__" in text or "${" in text or text.startswith("var."):
+            return True
+        if text in accepted:
+            return True
+    return False

attackmap_analyzer_iac-0.2.0.dist-info/METADATA

@@ -0,0 +1,125 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-iac
+Version: 0.2.0
+Summary: Infrastructure-as-Code analyzer plugin for AttackMap (Dockerfile, docker-compose, Kubernetes, Helm, GitHub Actions, .env templates, shell installers)
+Author: AttackMap Contributors
+Author-email: Matthew Davis <mlaify@mlaify.io>
+Maintainer-email: Matthew Davis <mlaify@mlaify.io>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-iac
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-iac
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-iac/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-iac/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin,iac,docker,docker-compose,github-actions,kubernetes,helm
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Requires-Dist: PyYAML>=6.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.6.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.6.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-iac
+
+> [!IMPORTANT]
+> **Active development, slow pace.** AttackMap is under active development, but
+> progress may be slow until more contributors or co-maintainers join. Help is
+> very welcome with the core engine, an analyzer, the macOS app, or the docs —
+> see [CONTRIBUTING.md](CONTRIBUTING.md) or open an issue on
+> [mlaify/AttackMap](https://github.com/mlaify/AttackMap/issues) to say hello.
+> Security reports are still welcome at [security@mlaify.io](mailto:security@mlaify.io).
+
+Infrastructure-as-Code analyzer plugin for [AttackMap](https://github.com/mlaify/AttackMap).
+
+Covers the class of files that live outside application source but drive the actual runtime posture:
+
+- **Dockerfile** (also `Dockerfile.*`, `Dockerfile-*`, `*.Dockerfile`, `*.dockerfile`, `Containerfile*`): non-root user and healthcheck, both checked on the *final* build stage, including what it inherits from an earlier stage it is built `FROM`; exposed ports; `RUN curl | bash`; `ADD <url>`; base-image pinning, one hint per unpinned image, skipping `scratch` and stage aliases; literal secrets in `ENV`/`ARG`
+- **docker-compose** (`docker-compose*.y[a]ml`, `compose*.y[a]ml`, so overrides like `docker-compose.override.yml` too): service list (feeds the topology graph), `env_file` references, host-mount volumes, privileged containers, Docker socket mounts, `cap_add: SYS_ADMIN`/`ALL`, `pid: host`, `seccomp:unconfined`, published ports that bind all interfaces (explicit `0.0.0.0`, or short syntax with no host IP such as `"5432:5432"`), `network_mode: host`, and literal secrets in `environment:`
+- **GitHub Actions workflows** — `pull_request_target` with checkout, third-party actions pinned by tag vs SHA, secret exposure to fork PRs, step-level `permissions:`
+- **`.env` templates** (`.env.example`, `sample.env`) — secret inventory (the shape, not the value)
+- **Shell installers** — `curl | bash` patterns, `sudo` scope, TLS material handling
+- **Kubernetes manifests** (any `.yaml`/`.yml` with top-level `apiVersion:` and `kind:`) — workloads (`Pod`, `Deployment`, `StatefulSet`, `DaemonSet`, `ReplicaSet`, `Job`, `CronJob`, `ReplicationController`): `privileged`, `allowPrivilegeEscalation: true`, `runAsUser: 0`, missing `runAsNonRoot` / `allowPrivilegeEscalation: false`, `hostPath` volumes (high for the runtime socket, `/`, `/etc`, `/proc`, `/sys`, `/dev`, `/var/lib/kubelet`…), `hostNetwork`/`hostPID`/`hostIPC`, dangerous capabilities, `Unconfined` seccomp/AppArmor, `:latest`/untagged images; RBAC roles with `*` on core/RBAC/apps groups, `escalate`/`bind`/`impersonate`, `pods/exec`, Secret reads; bindings to `cluster-admin` or `system:authenticated`/`unauthenticated`/`anonymous`; `LoadBalancer`/`NodePort` Services without `loadBalancerSourceRanges` (entrypoints too; internal load balancers skipped); `Ingress` host/path rules (routes); literal `Secret` values
+- **Helm charts** — templates under `templates/` next to a `Chart.yaml` are read without rendering: `{{ }}` actions are stripped (line numbers kept) and a templated value is never reported, because the chart's values decide it. A setting inside `{{ if }}`/`{{ with }}` is reported with low confidence (it may be off by default). `values.yaml` defaults (`privileged`, `hostNetwork`/`hostPID`/`hostIPC`, `allowPrivilegeEscalation`, `runAsUser: 0`, capabilities) are reported with confidence 0.5
+
+Emits routes for exposed ports, external calls for third-party actions and `curl` fetches, `SecretHint` for env-template inventory, service-topology hints for compose `services:` — feeding the same pipeline as the source-code analyzers.
+
+### Misconfigurations and posture signals
+
+Every signal carries `file`, `line` and `evidence_text`. Signals about something *missing* (no `USER`, no `HEALTHCHECK`, no `permissions:`) point at the final `FROM` line or line 1.
+
+Container and cluster misconfigurations are `CloudMisconfig` records (`cloud_misconfigs`, iac#1), which AttackMap core turns into findings with CWE/OWASP ids. Each names the `resource` (`Deployment/web container app`, `service agent`), a per-instance `severity` and `confidence`, and an `escalation_path` (e.g. `container runtime socket → start a privileged container → root on the node`):
+
+| Kind | Dockerfile / compose | Kubernetes / Helm |
+|---|---|---|
+| `container_runs_as_root` | no `USER` in the final stage (low), `USER root` (medium) | `runAsUser: 0` |
+| `privileged_container` | `privileged: true` | `securityContext.privileged: true` |
+| `host_path_mount` | runtime socket and `/etc`, `/proc`, … bind mounts (`/srv/data` is not reported) | `hostPath` volumes |
+| `host_namespace_shared` | `pid: host`, `ipc: host`, `network_mode: host` | `hostPID`, `hostNetwork`, `hostIPC` |
+| `dangerous_capability` | `cap_add` | `capabilities.add` (`SYS_ADMIN`, `ALL`, `SYS_MODULE`, `SYS_PTRACE`, … high; `NET_ADMIN` medium) |
+| `security_profile_disabled` | `seccomp:unconfined`, `apparmor:unconfined` | `seccompProfile`/`appArmorProfile` `Unconfined` |
+| `unpinned_container_image` | `FROM image:latest` or untagged | `image:` `:latest` or untagged |
+| `dockerfile_remote_add` / `dockerfile_curl_pipe_shell` | `ADD <url>` without `--checksum`, `RUN curl \| sh` | |
+| `privilege_escalation_allowed`, `missing_security_context` (low) | | `allowPrivilegeEscalation: true`; no `runAsNonRoot` / `allowPrivilegeEscalation: false` |
+| `rbac_wildcard`, `rbac_escalation`, `rbac_secret_access`, `cluster_admin_binding`, `exposed_service` | | RBAC and Services |
+
+No `AuthHint`s are emitted: core reads those as auth signals, and one in a Dockerfile counted as an auth control for its `EXPOSE` route. With an AttackMap core older than the `CloudMisconfig` record, the old `AuthHint`s (`dockerfile_no_user_directive`, `dockerfile_user_root`, `compose_privileged_container`, `compose_docker_socket_mount`, `compose_cap_add_sys_admin`, `compose_pid_host`, `compose_seccomp_unconfined`) are emitted instead. The other signals are split by meaning (AttackMap#258):
+
+| Signal list | Hints |
+|---|---|
+| `entrypoint_hints` (network exposure) | `compose_port_binding_all_interfaces:<binding>`, `compose_network_mode_host`, `k8s_service_loadbalancer:<name>`, `k8s_service_nodeport:<name>`, `k8s_ingress:<host>` |
+| `framework_hints` (build, supply-chain, CI and deployment config) | `dockerfile_no_healthcheck`, `dockerfile_run_curl_pipe`, `dockerfile_add_remote`, `dockerfile_base_image_unpinned:<image>`, `compose_env_file_reference`, `compose_host_mount:<host path>`, `gha_third_party_action_tag_pinned:<owner/repo>`, `gha_pull_request_target_with_checkout`, `gha_no_top_level_permissions`, `shell_curl_pipe_installer`, `shell_sudo_used`, `shell_permissive_chmod` |
+| `service_hints` | `service_name:<compose service>` |
+
+The Dockerfile user check looks at the final stage's effective user (the last `USER`, inherited through `FROM <stage>`). A `USER nobody` in a builder stage doesn't hide a root final image, and `USER root` followed by `USER app` isn't flagged. A final base tagged `:nonroot` counts as setting a user.
+
+Secret-shaped `ENV`/`ARG` names (`*SECRET*`, `*TOKEN*`, `*PASSWORD*`, `*_KEY`, …) and `environment:` entries with a literal value become `SecretHint(kind="hardcoded")`. `*_FILE` paths, `${VAR}` references, booleans and `ARG` without a default are not flagged.
+
+Bluesky FINDINGS §2 documented this as the biggest coverage gap: `bluesky-social/pds` (a deployment repo) was 95% invisible to AttackMap because every non-JS file was outside the analyzer model. This plugin closes that gap.
+
+## Install
+
+```bash
+uv tool install attackmap --with attackmap-analyzer-iac \
+  --index mlaify=https://pkg.mlaify.io/pypi/simple/ --index-strategy first-index
+# or from source:
+pip install git+https://github.com/mlaify/attackmap-analyzer-iac.git
+# or as part of the bundle
+pip install "attackmap[all] @ git+https://github.com/mlaify/AttackMap.git"
+```
+
+## Usage
+
+Runs automatically via the `attackmap.analyzers` entry-point group once installed:
+
+```bash
+attackmap analyze /path/to/deployment-repo --output reports
+```
+
+## Contract
+
+Implements `AnalyzerProtocol` from `attackmap.sdk`. See the [external-analyzer guide](https://github.com/mlaify/AttackMap/blob/main/docs/external-analyzers.md).
+
+## Scope
+
+**In:** patterns any competent operator recognizes on inspection — the docker-compose service graph, `pull_request_target` combined with untrusted checkout, non-root User directive presence, curl-piped installer scripts.
+
+**Out:** deep semantic analysis of container image contents, live registry scanning, executed-runtime introspection. Those belong in other tools; AttackMap's differentiator is narrative attack-path reasoning over the code you can see.

attackmap_analyzer_iac-0.2.0.dist-info/RECORD

@@ -0,0 +1,10 @@
+attackmap_analyzer_iac/__init__.py,sha256=LfcfmMs_g8mrDejtXJ_ZKd7gFxW-hfoAwnK9h_L_ggU,61
+attackmap_analyzer_iac/analyzer.py,sha256=CaruInKUt_26Ex2oz_p4tvc7Hrqe65YWPIq3dkzElj0,40061
+attackmap_analyzer_iac/k8s.py,sha256=ob1tP_I4MlJQL4V1fxOmBTETqyAetMze_NqHFc2KMlA,30981
+attackmap_analyzer_iac/records.py,sha256=xEi6EhKv8Skt6PNzWDD73bglHCbFGxT1EPgKE7LweeM,9974
+attackmap_analyzer_iac-0.2.0.dist-info/licenses/LICENSE,sha256=vtPQVGUyxq359j0JmD3_eJaXyHmaHyjzaMOtaLwJc88,1097
+attackmap_analyzer_iac-0.2.0.dist-info/METADATA,sha256=qKXMUTd80RB5BlupL7qmGf7Xv8_MJiHO8iBOmYpEL_E,10657
+attackmap_analyzer_iac-0.2.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+attackmap_analyzer_iac-0.2.0.dist-info/entry_points.txt,sha256=8s0ttnoJWChZWfjezqokU7l3wyyF2UQne_Xj0Nlu-fo,63
+attackmap_analyzer_iac-0.2.0.dist-info/top_level.txt,sha256=0RcqPMapdhERWyJIirMDbHofmUmxrj7H-4Vp6dlTmsw,23
+attackmap_analyzer_iac-0.2.0.dist-info/RECORD,,

attackmap_analyzer_iac-0.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

attackmap_analyzer_iac-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+iac = attackmap_analyzer_iac:IacAnalyzer

attackmap_analyzer_iac-0.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_iac-0.2.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_iac