AI PRP: Request Weak Credential tester for Apache Hive

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.

Apache License 2.0

860 stars 178 forks source link

AI PRP: Request Weak Credential tester for Apache Hive #418

Open maoning opened 3 months ago

maoning commented 3 months ago

This requires adding a JDBC to connect to Apache Hive database to test for authentication. The tester should also check for services with no authentication.

Please read the rules of engagement first at https://github.com/google/tsunami-security-scanner-plugins/issues/409.

secureness commented 3 months ago

I'd like to write a tsunami plugin for this request.

secureness commented 3 months ago

@maoning I'm able to run a sample jdbc code and set up a hive instance. could you assign this to me?

maoning commented 3 months ago

@secureness Please finish the implementation for https://github.com/google/tsunami-security-scanner-plugins/issues/433 first.

W0ngL1 commented 2 months ago

Hi @maoning, I've finished #435, could you assign this issue to me?

maoning commented 1 month ago

@secureness I see that you have a few plugins in the backlog, I will prioritize reviewing of those plugins. @vsutedjo will review and merge in #433 shortly. To maximize the throughput, @W0ngL1 you can start working on this request.

[ ] Submit the vulnerable & secure configurations of the target application to google/security-testbeds.
[ ] Submit our participation form.

W0ngL1 commented 1 month ago

Thanks @maoning, I'll start to work on this.

secureness commented 1 month ago

@maoning you didn't assign any of the AI PRPs to me that you created initially, I had hoped that I could write at least one AI PRP that you created. one more thing, Do rules matter when we can ignore those here? we are doing bug bounty here with rules, with this thing that happened here I can go to other issues where the contributors have multiple PRPs in their backlogs and start asking you to assign the PRP to me that they asked first to work on. @W0ngL1 could do research like my other PRPs on open-source and commercial AI products to see whether they can have potential security issues or not( like other contributors as far as I see) instead of asking to work on an issue that someone else requested sooner.