ahmetak4n / radar

Scanner for misconfigured DevSecOps or Security tools on internet like SonarQube, GoPhish etc.

radar

A lot of tool using in DevSecOps pipelines. But DevSecOps process does not include secure configuration of these tools. That's why too many misconfigured DevSecOps tools exist on internet. Also so many security tools used for Phishing or Scanning are available on internet with old versions or misconfigured way or default credentials.

The Radar find DevSecOps or Security tools via Shodan and check their configuration.

Scanned Tools:

• SonarQube
  • Check default credential
  • Show public projects and details
  • Download source codes from selected project
• GoPhish
  • Check default credential

build

git clone https://github.com/ahmetak4n/radar.git
cd radar
go buid radar.go

usage

Help
./radar -h

Scan misconfigured SonarQube services
./radar sonarqube -aK $SHODAN_API_KEY

Scan Gophish services that work run with default credentials
./radar gophish -aK $SHODAN_API_KEY

screenshots

Find sonarqube services

Download source code from detected sonarqube services

Find gophish services

disclaimer

Radar is developed for InfoSec persons. It should be used for authorized testing and/or educational purposes only. I take no responsibility for the abuse of Radar

radar's Issues

Fix code scanning alert - Fuzzing

OpenSSF OSS-Fuzz integration will be added

Tracking issue for:

• https://github.com/ahmetak4n/radar/security/code-scanning/25