- Eline Henriksen <mains.moon.0x@icloud.com>

- Michael Kruggel <michael.kruggel@defenseunicorns.com>

- Ochi Daiki<lbfdeatq@gmail.com>

- Kai Schäfer <kai.schaefer@claranet.com>

- Kai Schäfer <kai.schaefer@claranet.com>

- Joel Saß <joel.sass@iteratec.com>

{{- /*

SPDX-FileCopyrightText: the secureCodeBox authors

SPDX-License-Identifier: Apache-2.0

*/ -}}

{{- define "extra.docsSection" -}}

---

title: "subfinder"

category: "scanner"

type: "Network"

state: "released"

appVersion: "{{ template "chart.appVersion" . }}"

usecase: "NEW SCANNER USECASE"

---

ADD A [LOGO]() HERE!

{{- end }}

{{- define "extra.dockerDeploymentSection" -}}

## Supported Tags

- `latest` (represents the latest stable release build)

- tagged releases, e.g. `{{ template "chart.appVersion" . }}`

{{- end }}

{{- define "extra.chartAboutSection" -}}

## What is subfinder?

Please write some information about the new scanner.

{{- end }}

{{- define "extra.scannerConfigurationSection" -}}

Please write how to configure the scanner

{{- end }}

{{- define "extra.chartConfigurationSection" -}}

Please include any extra Helm chart configurations that can be useful.

{{- end }}

{{- define "extra.scannerLinksSection" -}}

Please include any links that can be used as a reference for the scanner.

{{- end }}

# SPDX-FileCopyrightText: the secureCodeBox authors

#

# SPDX-License-Identifier: Apache-2.0

# Patterns to ignore when building packages.

# This supports shell glob matching, relative path matching, and

# negation (prefixed with !). Only one pattern per line.

.DS_Store

# Common VCS dirs

.git/

.gitignore

.bzr/

.bzrignore

.hg/

.hgignore

.svn/

# Common backup files

*.swp

*.bak

*.tmp

*~

# Various IDEs

.project

.idea/

*.tmproj

.vscode/

# Node.js files

node_modules/*

package.json

package-lock.json

src/*

config/*

Dockerfile

.dockerignore

*.tar

parser/*

scanner/*

integration-tests/*

examples/*

docs/*

Makefile

apiVersion:v2

name:subfinder

description:A Helm chart for the subfinder security Scanner that integrates with the secureCodeBox.

type:application

version:v3.1.0-alpha1

appVersion:"v2.7.0"

kubeVersion:">=v1.11.0-0"

annotations:

supported-platforms:linux/amd64

keywords:

-security

-subfinder

-scanner

-secureCodeBox

-subdomain

-discovery

home:https://github.com/projectdiscovery/subfinder

icon:https://www.securecodebox.io/img/integrationIcons/subfinder.svg# TODO: Muss ich hier ein eigenes bild "uploaden"

sources:

-https://github.com/secureCodeBox/secureCodeBox

maintainers:

-name:iteratec GmbH

email:secureCodeBox@iteratec.com

include_guard = set

scanner = subfinder

include ../../scanners.mk

title:"subfinder"

category:"scanner"

type:"Network"

state:"released"

appVersion:""

usecase:"NEW SCANNER USECASE"

ADD A[LOGO]() HERE!

<palign="center">

<ahref="https://opensource.org/licenses/Apache-2.0"><imgalt="License Apache-2.0"src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"/></a>

<ahref="https://github.com/secureCodeBox/secureCodeBox/releases/latest"><imgalt="GitHub release (latest SemVer)"src="https://img.shields.io/github/v/release/secureCodeBox/secureCodeBox?sort=semver"/></a>

<ahref="https://owasp.org/www-project-securecodebox/"><imgalt="OWASP Lab Project"src="https://img.shields.io/badge/OWASP-Lab%20Project-yellow"/></a>

<ahref="https://artifacthub.io/packages/search?repo=securecodebox"><imgalt="Artifact HUB"src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/securecodebox"/></a>

<ahref="https://github.com/secureCodeBox/secureCodeBox/"><imgalt="GitHub Repo stars"src="https://img.shields.io/github/stars/secureCodeBox/secureCodeBox?logo=GitHub"/></a>

<ahref="https://infosec.exchange/@secureCodeBox"><imgalt="Mastodon Follower"src="https://img.shields.io/mastodon/follow/111902499714281911?domain=https%3A%2F%2Finfosec.exchange%2F"/></a>

</p>

Please write some information about the new scanner.

The subfinder chart can be deployed via helm:

helm upgrade --install subfinder oci://ghcr.io/securecodebox/helm/subfinder

Please write how to configure the scanner

Kubernetes:`>=v1.11.0-0`

Please include any extra Helm chart configurations that can be useful.

| Key| Type| Default| Description|

|-----|------|---------|-------------|

| cascadingRules.enabled| bool|`false`| Enables or disables the installation of the default cascading rules for this scanner|

| imagePullSecrets| list|`[]`| Define imagePullSecrets when a private registry is used (see:https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/)|

| parser.affinity| object|`{}`| Optional affinity settings that control how the parser job is scheduled (see:https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/)|

| parser.env| list|`[]`| Optional environment variables mapped into each parseJob (see:https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)|

| parser.image.pullPolicy| string|`"IfNotPresent"`| Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if:latest tag is specified, or IfNotPresent otherwise. More info:https://kubernetes.io/docs/concepts/containers/images#updating-images|

| parser.image.repository| string|`"docker.io/securecodebox/parser-subfinder"`| Parser image repository|

| parser.image.tag| string| defaults to the charts version| Parser image tag|

| parser.nodeSelector| object|`{}`||

| parser.resources| object|`{ requests: { cpu: "200m", memory: "100Mi" }, limits: { cpu: "400m", memory: "200Mi" } }`| Optional resources lets you control resource limits and requests for the parser container. Seehttps://kubernetes.io/docs/concepts/configuration/manage-resources-containers/|

| parser.scopeLimiterAliases| object|`{}`| Optional finding aliases to be used in the scopeLimiter.|

| parser.tolerations| list|`[]`| Optional tolerations settings that control how the parser job is scheduled (see:https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)|

| parser.ttlSecondsAfterFinished| string|`nil`| seconds after which the Kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller:https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/|

| scanner.activeDeadlineSeconds| string|`nil`| There are situations where you want to fail a scan Job after some amount of time. To do so, set activeDeadlineSeconds to define an active deadline (in seconds) when considering a scan Job as failed. (see:https://kubernetes.io/docs/concepts/workloads/controllers/job/#job-termination-and-cleanup)|

| scanner.affinity| object|`{}`| Optional affinity settings that control how the scanner job is scheduled (see:https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/)|

| scanner.backoffLimit| int| 3| There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see:https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-backoff-failure-policy)|

| scanner.env| list|`[]`| Optional environment variables mapped into each scanJob (see:https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)|

| scanner.extraContainers| list|`[]`| Optional additional Containers started with each scanJob (see:https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)|

| scanner.extraVolumeMounts| list|`[]`| Optional VolumeMounts mapped into each scanJob (see:https://kubernetes.io/docs/concepts/storage/volumes/)|

| scanner.extraVolumes| list|`[]`| Optional Volumes mapped into each scanJob (see:https://kubernetes.io/docs/concepts/storage/volumes/)|

| scanner.image.pullPolicy| string|`"IfNotPresent"`| Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if:latest tag is specified, or IfNotPresent otherwise. More info:https://kubernetes.io/docs/concepts/containers/images#updating-images|

| scanner.image.repository| string|`"docker.io/securecodebox/scanner-subfinder"`| Container Image to run the scan|

| scanner.image.tag| string|`nil`| defaults to the charts appVersion|

| scanner.nameAppend| string|`nil`| append a string to the default scantype name.|

| scanner.nodeSelector| object|`{}`| Optional nodeSelector settings that control how the scanner job is scheduled (see:https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/)|

| scanner.podSecurityContext| object|`{}`| Optional securityContext set on scanner pod (see:https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)|

| scanner.resources| object|`{}`| CPU/memory resource requests/limits (see:https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/,https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)|

| scanner.securityContext| object|`{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}`| Optional securityContext set on scanner container (see:https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)|

| scanner.securityContext.allowPrivilegeEscalation| bool|`false`| Ensure that users privileges cannot be escalated|

| scanner.securityContext.capabilities.drop[0]| string|`"all"`| This drops all linux privileges from the container.|

| scanner.securityContext.privileged| bool|`false`| Ensures that the scanner container is not run in privileged mode|

| scanner.securityContext.readOnlyRootFilesystem| bool|`true`| Prevents write access to the containers file system|

| scanner.securityContext.runAsNonRoot| bool|`true`| Enforces that the scanner image is run as a non root user|

| scanner.suspend| bool|`false`| if set to true the scan job will be suspended after creation. You can then resume the job using`kubectl resume <jobname>` or using a job scheduler like kueue|

| scanner.tolerations| list|`[]`| Optional tolerations settings that control how the scanner job is scheduled (see:https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)|

| scanner.ttlSecondsAfterFinished| string|`nil`| seconds after which the Kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller:https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/|

[](https://opensource.org/licenses/Apache-2.0)

Code of secureCodeBox is licensed under the[Apache License 2.0][scb-license].

[scb-owasp]:https://www.owasp.org/index.php/OWASP_secureCodeBox

[scb-docs]:https://www.securecodebox.io/

[scb-site]:https://www.securecodebox.io/

[scb-github]:https://github.com/secureCodeBox/

[scb-mastodon]:https://infosec.exchange/@secureCodeBox

[scb-slack]:https://owasp.org/slack/invite

[scb-license]:https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE

Please include any links that can be used as a reference for the scanner.

apiVersion:"execution.securecodebox.io/v1"

kind:Scan

metadata:

name:"subfinder-localhost"

spec:

scanType:"subfinder"

parameters:

-localhost