anteater - Anteater - CI/CD Gate Check Framework

项目说明

Anteater - CI/CD Gate Check Framework

!anteater

![Build Status]()
![Documentation Status]()

Description
-----------

Anteater is an open framework to prevent the unwanted merging of nominated strings,
filenames, binaries, depreciated functions, staging en code / credentials
etc. Anything that can be specified with regular expression syntax, can be
sniffed out by anteater.

You tell anteater exactly what you don't want to get merged, and anteater looks
after the rest.

If anteater finds something, it exits with a non-zero code which in turn fails
the build of your CI tool, with the idea that it would prevent a pull request
merging. Any false positives are easily negated by using the
same RegExp framework to cancel out the false match.

Entire projects may also be scanned also, using a recursi walk.

With a few simple steps it can be easily implemented into a CI / CD workflow
with tooling such as Travis CI, CircleCI, Gitlab CI/CD and Jenkins.

It is currently used in the Linux Foundations project 'OPNFV'
as means to provide automated security checks at gate, but as shown in the
examples below, it can be used for other scenarios.

Anteater also provides integrates with the Virus Total API, so any binaries,
public IP addresses or URL's found by anteater, will be sent to the Virus Total
API and a report will be returned. If any object is reported as malicous,
it will fail the CI build job.

Example content is provided for those unsure of what to start with and its
encouraged and welcomed to share any Anteater filter strings you find useful.

Why would I want to use this?
-----------------------------

Anteater has many uses, and can easily be bent to cover your own specific needs.

First, as mentioned, it can be set up to block strings and files with a
potential security impact or risk. This could include private keys, a shell
history, aws credentials etc.

It is especially useful at ensuring that elements used in a staging /
de en don't find there way into a production en.

Let's take a look at some examples:

The above will match code where a flask server is set to running in debug mode
` app.run(host='0.0.0.0' port=80 debug=true), which can be typical to a
de en and mistakenly staged into production.

For a rails app, this could be:

regex: \<%=.*debug.*%>

Even more simple, look for the following in most logging frameworks:

regex: log\.debug

Need to stop de mistakenly adding a private key?

How about credential files that would cause a job loss if e into
production? Anteater works with file names too.

For Example:

jenkins\.plugins\.publish_o\.BapSshPublisherPlugin\.xml

Or even..

If your app has its own custom secrets / config file, then its very easy to
add your own regular expressions. E is set using YAML formatting,
so no need to change anteaters code.

Depreciated functions, classes etc
----------------------------------

Another use is for when a project depreciates an old function, yet de
might still make pull requests using the old function naming:

Or perhaps stopping people from using 1.x of a framework:

<script.src.*="https:\/\/ajax\.googleapis\.com\/ajax\/libs\/angularjs\/1.*<\/script>

What if I get false postives?
-----------------------------

Easy, you set a RegExp to stop the match , kind of like RegExp'ception.

Let's say we want to stop use of MD5:

This then incorrectly gets matched to the following:

mystring = int(amd500) * 4

We set a specific ignore RegEx, so it matches and then is unmatched by the
ignore entry.

mystring.=.int\(amd500\).*

Yet other instance of MD5 continue to get flagged.

Binaries
--------

With anteater, if you pass the argument --binaries, any binary found
causes a build failure on the originating pull request. It is not until a
sha256 checksum is set within anteater's YAML ignore files, that the build is
allowed to pass.

This means you can block people from checking in compiled objects, images, PDFs
etc that may have an unknown origin or tampering with the existing binary files.

An example:

Let's enter the hash::

Run the job again::

This way we can sure binaries are not tampered with by means of a failed
cryptographic signature / checksum.

Any binaries not having a sha256 checksum will also be sent to the Virus Total
API for scanning.

Virus Total API
---------------

If the following flags (combined or indi) --ips, -urls, --binaries
are used, anteater will perform a lookup to the Virus Total API.

IP addresses, will be ha DNS history checked for any previous or present connection
with known black listed domains marked as malicious or containing malware.

URLs, will be checked for any previous or present connection with known black listed domains
marked as malicious or containing malware.

As mentioned, Binaries will be sent to Virus Total and as clean / infected.

For more details and indepth documentation, please visit readthedocs

Last of all, if you do use anteater, I would love to know (twitter: )
and pull requests / issues are welcome!

Contribute
----------

Contributions are welcome.

Please make a pull request in a new branch, and not master.

Unit tests and PEP8 checks are in tox, so simply run the tox` command before
pushing your code.

If your patch fixes and issue, please paste the issue url into the commit
message.

项目信息

开发语言：Python

Star 数：175

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Anteater - CI/CD Gate Check Framework展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。