Jira scan, add possibility to use JQL to limit the scope of the scan

[fwsl]

Hello,

Adding possibility to use JQL filter would be a great improvement.
This would, not only, allow to limit the scope of the scan to specific project or projects, but also allow to scan issues per user, per any configured field or even based on creation or modification date.
This means that we could run scans on a large Jira instance to only scan issues updated in defined time.

Please let me know if you'd need any details.
Thanks

[blupants]

Hello,

Adding possibility to use JQL filter would be a great improvement. This would, not only, allow to limit the scope of the scan to specific project or projects, but also allow to scan issues per user, per any configured field or even based on creation or modification date. This means that we could run scans on a large Jira instance to only scan issues updated in defined time.

Please let me know if you'd need any details. Thanks

That is a great suggestion! I will include it in the next release. Once I get the code ready, I will share a branch with you so you can validate the solution on your end too before release. Thanks for being part of the n0s1 community!

[blupants]

Hooray, @fwsl! I managed to quickly create a draft (branch ms/scoped-search). Feel free to test it.

Here is how to run some examples. I have Jira projects MAR and Auto Service. I wanted to run one query skipping MAR and another one skipping both of them.

In order to do that, I ran scans using the following Jira queries via argument --scope:

project != MAR
project != MAR AND project != "Auto Service"

Keep in mind that if your jql has double quotes, you will need to escape it for the CLI. Also make sure to include jql: before your query. Ex: --scope "jql:project != MAR"

git clone -b ms/scoped-search https://github.com/spark1security/n0s1.git
cd n0s1/src/n0s1
python3 -m venv n0s1_python
source n0s1_python/bin/activate
python3 -m pip install -r ../../requirements.txt
python3 n0s1.py jira_scan --email marcelo@spark1.us --server https://spark1us.atlassian.net --scope "jql:project != MAR"
python3 n0s1.py jira_scan --email marcelo@spark1.us --server https://spark1us.atlassian.net --scope "jql:project != MAR AND project != \"Auto Service\""
generic:
python3 n0s1.py jira_scan --server "https://<YOUR_JIRA_SERVER>.atlassian.net" --api-key "<YOUR_JIRA_API_TOKEN>" --scope "jql:project != MAR AND project != \"Auto Service\""
deactivate

[fwsl]

Hello @blupants ,

WOW! You're really quick.
I did few basic tests and it looks really good.
When running, I'm seeing some Deprecation warnings.

I saw that you've also added something for Confluence, will it be able to scan specific space, or specific page?

Thanks

INFO:root:Starting scan in community mode...
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '(p8e-)(?i)[a-z0-9]{3' (truncated) but at position 6
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '(LTAI)(?i)[a-z0-9]{2' (truncated) but at position 6
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '(CLOJARS_)(?i)[a-z0-' (truncated) but at position 10
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression ''\"(?i)[' (truncated) but at position 15
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '['\"]duffel_(test|li' (truncated) but at position 24
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '['\"]dt0c01\.(?i)[a-' (truncated) but at position 13
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '['\"]EZAK(?i)[a-z0-9' (truncated) but at position 9
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '['\"]EZTK(?i)[a-z0-9' (truncated) but at position 9
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'FLWPUBK_TEST-(?i)[a-' (truncated) but at position 13
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'FLWSECK_TEST-(?i)[a-' (truncated) but at position 13
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'fio-u-(?i)[a-z0-9-=' (truncated) but at position 6
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '['\"]live(?i)[a-z0-' (truncated) but at position 10
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '['\"]eyJrIjoi(?i)[a-' (truncated) but at position 13
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression ''\"[a-z0-9]{14' (truncated) but at position 5
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'ion_(?i)[a-z0-9]{42}' but at position 4
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'lin_api_(?i)[a-z0-9]' (truncated) but at position 8
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression '['\"](npm_(?i)[a-z0-' (truncated) but at position 10
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'pscale_pw_(?i)[a-z0-' (truncated) but at position 10
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'pscale_tkn_(?i)[a-z0' (truncated) but at position 11
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'PMAK-(?i)[a-f0-9]{24' (truncated) but at position 5
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'SG\.(?i)[a-z0-9_\-\.' (truncated) but at position 4
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'xkeysib-[a-f0-9]{64}' (truncated) but at position 22
m = re.search(regex_str, text)
/mnt/d/tmp/n0s1/src/n0s1/n0s1.py:405: DeprecationWarning: Flags not at the start of the expression 'xsmtpsib-[a-f0-9]{64' (truncated) but at position 23
m = re.search(regex_str, text)

[blupants]

Hi @fwsl , thanks for testing the branch!

WOW! You're really quick. I did few basic tests and it looks really good. When running, I'm seeing some Deprecation warnings.

I have fixed the deprecation warning. Run a git pull to get the latest updates from branch ms/scoped-search and you should get a clean stdout.

I saw that you've also added something for Confluence, will it be able to scan specific space, or specific page?

It will support standard Confluence CQL. Yes, you should be able to scan specific spaces or pages, as long as you create a CQL for it.

For instance, if you want to scan all pages from the space KB you can run:

python3 n0s1.py confluence_scan --email marcelo@spark1.us --server https://spark1us.atlassian.net --scope "cql:space=KB and type=page"

If you have a page called "How to use AWS CLI" where the page ID is 262160, you can scan it using:

python3 n0s1.py confluence_scan --email marcelo@spark1.us --server https://spark1us.atlassian.net --scope "cql:title = \"How to use AWS CLI\""
or
python3 n0s1.py confluence_scan --email marcelo@spark1.us --server https://spark1us.atlassian.net --scope "cql:id=262160"

Those are just some examples. At the end of the day you can build any query using CQL that you want. Same thing for Jira JQL, GitHub search and Slack search.

[blupants]

Feature request has been implemented and added to the latest release: https://github.com/spark1security/n0s1/releases/tag/v1.0.27