8000 Find and fix sensitive info in mongo · Issue #1454 · guardicore/monkey · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
Find and fix sensitive info in mongo #1454
Closed
@VakarisZ

Description

@VakarisZ

Describe the bug

If a password is used to exploit a machine, it gets stored in the report in plaintext.

To Reproduce

Steps to reproduce the behavior:

  1. Exploit machine with any brute-force exploiter
  2. Generate a report
  3. Check mongodb
  4. The password used for exploit is stored in plaintext

Expected behavior

Use the same mechanism we use for configuration.

Tasks

  • Do a realistic monkey run and audit the database searching for sensitive plaintext information (0d) - @VakarisZ
  • Write a function to encrypt values in a dictionary based on keys specified (0.25d) @VakarisZ
  • Separate the report/telemetry/whatever and the db access with a layer of encryption (0d) @VakarisZ

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    0