Changing hostname indemnification to L0 keeps DNSSEC findings

minvws / nl-kat-coordination

OpenKAT scans networks, finds vulnerabilities and creates accessible reports. It integrates the most widely used network tools and scanning software into a modular framework, accesses external databases such as shodan, and combines the information from all these sources into clear reports. It also includes lots of cat hair.

https://openkat.nl

European Union Public License 1.2

126 stars 58 forks source link

Changing hostname indemnification to L0 keeps DNSSEC findings #1080

Open zcrt opened 1 year ago

zcrt commented 1 year ago

Describe the bug Changing a hostname indemnification to L0 keeps DNSSEC findings while removing DKIM, DMARC and SPF findings.

To Reproduce Steps to reproduce the behavior:

Scan hostname with no DNSSEC and no DKIM/DMARC/SPF
Make sure the findings are there
Change hostname indemnification to L0
Notice the DKIM/DMARC/SPF findings disappear, but the DNSSEC finding stays.

Expected behavior Removal of DNSSEC finding

OpenKAT version 1.8.0.1

noamblitz commented 1 year ago

DNSSEC findings are created by a boefje and not by a bit. Therefore this is not a bug. Since the DNSSEC boefje will not rerun when clearance is set to L0, the findings will not disappear.

zcrt commented 1 year ago

Sounds to me that the bug is then either:

Findings are directly created by a boefje instead of leaving that to a bit
Findings are not disappearing when their original input (e.g. hostname) is no longer a valid input (L0) for the boefje(s) that created the finding

noamblitz commented 1 year ago

Well thats not really a bug imo.

Prohibiting boefjes from creating findings, in this case, can be a choice indeed. But thats really more a choice than a bug. Also, removing clearence - from now on - means that that ooi cannot be scanned anymore, removing all data gathered by boefjes about that ooi should not happen imo.

zcrt commented 1 year ago

Agreed that gathered data should not be removed. However, in my opinion it should end up as historical data. E.g. if you search for the findings at a date where the hostname still had L1 the finding should be visible. If you search in the most recent view while the hostname has L0, they should not exist however.

noamblitz commented 1 year ago

Hmm that could be a nice feature indeed. Quite difficult to follow the trail and set all concurrent oois as historical as well, but i like the idea!

underdarknl commented 1 year ago

We could maybe offer an option to the user? When decreasing a scan level, what should we do with data created from scans using the higher now off limit levels? This would then also possibly be required for objects that are dependent on this object for their clearance level. Showing which objects are affected would be complex though.

noamblitz commented 1 year ago

For sure a good idea, but indeed, showing affected objects is hard