-
Notifications
You must be signed in to change notification settings - Fork 176
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add Weak Credential tester for Apache Hive #490
base: master
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @W0ngL1.
Thank you for your contribution. You can find all the issues to address down below. I'm also noticing that the plugin is a bit slow to run, i think that this is due to jdbc, but i'm not 100% sure of that. Can you please check it?
Feel free to reach out
~ Leonardo(Doyensec)
...s/detectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTester.java
Show resolved
Hide resolved
...s/detectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTester.java
Outdated
Show resolved
Hide resolved
...s/detectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTester.java
Outdated
Show resolved
Hide resolved
...s/detectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTester.java
Outdated
Show resolved
Hide resolved
...s/detectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTester.java
Outdated
Show resolved
Hide resolved
...tectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTesterTest.java
Show resolved
Hide resolved
...tectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTesterTest.java
Show resolved
Hide resolved
...tectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTesterTest.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for your quick changes @W0ngL1. You can find some issues to address down below.
Moreover i'm noticing, while running the plugin, a series of error related to logging. The output is the following. Can you please investigate into it?
ERROR StatusLogger Unrecognized format specifier [d]
ERROR StatusLogger Unrecognized conversion specifier [d] starting at position 16 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [thread]
ERROR StatusLogger Unrecognized conversion specifier [thread] starting at position 25 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [level]
ERROR StatusLogger Unrecognized conversion specifier [level] starting at position 35 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [logger]
ERROR StatusLogger Unrecognized conversion specifier [logger] starting at position 47 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [msg]
ERROR StatusLogger Unrecognized conversion specifier [msg] starting at position 54 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [n]
ERROR StatusLogger Unrecognized conversion specifier [n] starting at position 56 in conversion pattern.
ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console.
ERROR StatusLogger Unrecognized format specifier [d]
ERROR StatusLogger Unrecognized conversion specifier [d] starting at position 16 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [thread]
ERROR StatusLogger Unrecognized conversion specifier [thread] starting at position 25 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [level]
ERROR StatusLogger Unrecognized conversion specifier [level] starting at position 35 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [logger]
ERROR StatusLogger Unrecognized conversion specifier [logger] starting at position 47 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [msg]
ERROR StatusLogger Unrecognized conversion specifier [msg] starting at position 54 in conversion pattern.
ERROR StatusLogger Unrecognized format specifier [n]
ERROR StatusLogger Unrecognized conversion specifier [n] starting at position 56 in conversion pattern.
...s/detectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTester.java
Outdated
Show resolved
Hide resolved
...tectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTesterTest.java
Show resolved
Hide resolved
...s/detectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTester.java
Outdated
Show resolved
Hide resolved
Hi @leonardo-doyensec, It's ok when I run it, can you try again? It seems to be caused by logger, I removed it. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @W0ngL1. You can find some issues to address down below.
...s/detectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTester.java
Outdated
Show resolved
Hide resolved
...tectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTesterTest.java
Outdated
Show resolved
Hide resolved
...tectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTesterTest.java
Show resolved
Hide resolved
...s/detectors/credentials/genericweakcredentialdetector/testers/hive/HiveCredentialTester.java
Outdated
Show resolved
Hide resolved
Hi @leonardo-doyensec, please review again if you're free :) |
Thank you for your changes @W0ngL1. Feel free to reach out |
Sorry for that @leonardo-doyensec. I've fixed it and tested it.
|
Hi @W0ngL1. Seems like that this error appears when using an empty password during the bruteforce.
|
Hi @maoning,
PR for AI PRP: Request Weak Credential tester for Apache
And the PR for dependents of hive-jdbc is google/tsunami-security-scanner#113, PR for testbeds is google/security-testbeds#58