Metadata-Version: 2.1
Name: ingysec
Version: 0.2.0
Summary: 
Author: briskdust
Author-email: briskdust@gmail.com
Requires-Python: >=3.12,<4.0
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Requires-Dist: bandit (>=1.7.8,<2.0.0)
Requires-Dist: boofuzz (>=0.4.2,<0.5.0)
Requires-Dist: flask (>=3.0.3,<4.0.0)
Requires-Dist: flask-cors (>=4.0.0,<5.0.0)
Requires-Dist: requests (>=2.31.0,<3.0.0)
Requires-Dist: requests-toolbelt (>=1.0.0,<2.0.0)
Requires-Dist: semgrep (>=1.75.0,<2.0.0)
Requires-Dist: tabulate (>=0.9.0,<0.10.0)
Description-Content-Type: text/markdown

# Security Scanner CLI Tool

A Command Line Interface (CLI) tool for scanning and analyzing mobile APK files and Docker images for security vulnerabilities using MobSF and Trivy.

## Table of Contents

- [Installation](#installation)
- [Usage](#usage)
  - [Mobile Commands](#mobile-commands)
  - [Docker Commands](#docker-commands)
  - [Code Commands](#code-commands)
- [Extending the Tool](#extending-the-tool)
  - [Adding New Commands](#adding-new-commands)
  - [Adding New Functions](#adding-new-functions)
  - [Extending `shell_escape_finder.py`](#extending-shell_escape_finderpy)


## Installation

### Install from Source Code
1. **Clone the repository:**

    ```sh
    git clone https://github.com/briskdust/ingy-cli.git
    cd ingy-cli
    ```

2. **Install the required Python packages:**

    ```sh
    poetry install
    ```

3. **Ensure you have Docker installed and running**

4. **Run the CLI tool:**

    ```sh
    python -m ingysec.ingy
    ```

### Install using Pip

1. **Install the tool from PyPI:**

    ```sh
    pip install ingysec
    ```

2. **Run the CLI tool:**

    ```sh
    ingysec
    ```

## Usage

This CLI tool supports multiple commands grouped under `mobile`, `docker`, and `code`.

### Mobile Commands

Scan and analyze APK files for security vulnerabilities using MobSF.

#### Initialization
This command will initialize the MobSF docker container and run it on port 3000. It will also provide the API key for the MobSF server.
```shell
ingysec mobile mobsf_init
```

#### Configuration
Set the `MOBSF_APIKEY` environment variable with your MobSF API key:

    ```sh
    export MOBSF_APIKEY=your_mobsf_api_key
    ```

#### Scan APK Files

```sh
ingysec mobile mobsf --apikey YOUR_API_KEY --pdf output.pdf path/to/file1.apk path/to/file2.apk
```

- `files`: Paths to APK files.
- `--apikey`: API key for MobSF authentication. Or set the `MOBSF_APIKEY` environment variable.
- `--pdf`: Optional. If specified, generates a PDF report.

### Docker Commands

Run Trivy scan for a Docker image.

#### Installation
This command will install Trivy on your system. Only run it once, and it only works on **Linux(Debian/Ubuntu)** systems.
```shell
ingysec docker trivy_install
```

#### Scan Docker Images

```sh
ingy docker trivy --name IMAGE_NAME --html template.html
```

- `--name`: Name of the Docker image to scan.
- `--html`: Optional. Path to an HTML template file for generating the report. If not present, the results will be
    displayed in the terminal as a table.

### Code Commands
Run code inspection and scanning commands to detect security vulnerabilities in Python code.

#### Bandit
Run Bandit to check Python code for security vulnerabilities.

```sh
ingysec code bandit
```
Prompts the user to enter the path to the Python code.
Recursively scans all Python files in the specified path using the Bandit configuration file bandit.yaml.
Sets the severity level to high (-ll) and reports all discovered security issues.

#### Shell Escape
Scan code for potential shell escape vulnerabilities.

```sh
ingysec code shell-escape REPONAME --seckey PATH
```
The user needs to enter the path to the repository which can also be the URL of a remote repository and utilize the
`--seckey` flag to specify the path to the SSH private key for cloning the repository. Supports shell expansion, such as `~` to the full home directory path and verifies that the provided path is a directory.

## Extending the Tool

### Adding New Commands
To implement a new command, create a new command group in `ingysec/ingy.py`:
```python
@main.group()
def example_command():
"""This is an example command group."""
    pass
```

Then, add a new command to the group:
```python
@example_command.command()
def new_command():
"""This is a new command."""
    pass
```

### Adding New Functions
For the purpose of maintainability and clean code, add new functions to the `utils.py` file.

### Extending `shell_escape_finder.py`
To extend the script to support more languages, you need to update two main components:

1. **File Extensions**: Add the file extensions of the new languages to the `FILE_EXTENSIONS` list.
2. **Patterns**: Add regex patterns to identify potential shell escape vulnerabilities in the `PATTERNS` dictionary.

