x64-latacora
commented
2 months ago Right now, the only alternative is additional manual investigation.
Looking at the errors file that gets generated along with the results can help you figure out what failed, but otherwise this is all valid.
Is your feature request related to a problem? Please describe.
ScoutSuite can encounter various errors, including insufficient permissions to access something and rate-limiting errors. At this time, it logs an error message to the console and moves on. This isn't a terrible strategy, but it does mean that it's left with incomplete results. The problem is that the generated report does not indicate that results are incomplete. The rules engine also has no way to know that results are incomplete. As a result, the report may contain false positives or false negatives due to the incompleteness of the data that the rules engine processes.
Example: I recently had ScoutSuite tell me that some S3 Buckets were missing the "block public access" setting. But when I looked into the account, I didn't have permission to call
s3:GetAccountPublicAccessBlock(due to an SCP on the account). So presumably the rule is giving a false positive when the data isn't present.Describe the solution you'd like
There should be some way to expose to the rules engine that data may be missing. Generated reports should somehow display that certain rules could not be processed or may be missing targets due to incomplete data.
Describe alternatives you've considered
Right now, the only alternative is additional manual investigation.