From 7ae71c47d92ec1d602671b30e54ef8ae159232ef Mon Sep 17 00:00:00 2001
From: Paul <paul.schmelzer@iteratec.com>
Date: Mon, 14 Dec 2020 15:19:56 +0100
Subject: [PATCH 01/12] scanner/acstis

---
 scanners/angularjs-csti-scanner/.helmignore   |   5 +
 scanners/angularjs-csti-scanner/Chart.yaml    |  22 +++
 .../angularjs-csti-scanner/README.md.gotmpl   | 136 ++++++++++++++++
 .../examples/scan-single-url/README.md        |   1 +
 .../examples/scan-single-url/scan.yaml        |   9 ++
 .../scan-website-with-options/README.md       |  15 ++
 .../scan-website-with-options/scan.yaml       |  20 +++
 .../angularjs-csti-scanner/helm2.Chart.yaml   |  22 +++
 .../angularjs-csti-scanner/parser/Dockerfile  |   4 +
 .../acstis-test-empty-findings.txt            |   0
 .../__testFiles__/acstis-test-findings.txt    |   2 +
 .../angularjs-csti-scanner/parser/parser.js   |  51 ++++++
 .../parser/parser.test.js                     |  57 +++++++
 .../angularjs-csti-scanner/scanner/Dockerfile |   6 +
 .../scanner/acstis-script.py                  | 150 ++++++++++++++++++
 .../angularjs-csti-scanner/scanner/wrapper.sh |  14 ++
 ...gularjs-csti-scanner-parse-definition.yaml |   8 +
 .../angularjs-csti-scanner-scan-type.yaml     |  36 +++++
 scanners/angularjs-csti-scanner/values.yaml   |  46 ++++++
 19 files changed, 604 insertions(+)
 create mode 100644 scanners/angularjs-csti-scanner/.helmignore
 create mode 100644 scanners/angularjs-csti-scanner/Chart.yaml
 create mode 100644 scanners/angularjs-csti-scanner/README.md.gotmpl
 create mode 100644 scanners/angularjs-csti-scanner/examples/scan-single-url/README.md
 create mode 100644 scanners/angularjs-csti-scanner/examples/scan-single-url/scan.yaml
 create mode 100644 scanners/angularjs-csti-scanner/examples/scan-website-with-options/README.md
 create mode 100644 scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml
 create mode 100644 scanners/angularjs-csti-scanner/helm2.Chart.yaml
 create mode 100644 scanners/angularjs-csti-scanner/parser/Dockerfile
 create mode 100644 scanners/angularjs-csti-scanner/parser/__testFiles__/acstis-test-empty-findings.txt
 create mode 100644 scanners/angularjs-csti-scanner/parser/__testFiles__/acstis-test-findings.txt
 create mode 100644 scanners/angularjs-csti-scanner/parser/parser.js
 create mode 100644 scanners/angularjs-csti-scanner/parser/parser.test.js
 create mode 100644 scanners/angularjs-csti-scanner/scanner/Dockerfile
 create mode 100644 scanners/angularjs-csti-scanner/scanner/acstis-script.py
 create mode 100644 scanners/angularjs-csti-scanner/scanner/wrapper.sh
 create mode 100644 scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-parse-definition.yaml
 create mode 100644 scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml
 create mode 100644 scanners/angularjs-csti-scanner/values.yaml

diff --git a/scanners/angularjs-csti-scanner/.helmignore b/scanners/angularjs-csti-scanner/.helmignore
new file mode 100644
index 0000000000..2b6e53d709
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/.helmignore
@@ -0,0 +1,5 @@
+.DS_Store
+
+parser/
+scanner/
+examples/
\ No newline at end of file
diff --git a/scanners/angularjs-csti-scanner/Chart.yaml b/scanners/angularjs-csti-scanner/Chart.yaml
new file mode 100644
index 0000000000..4cc44ac19c
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/Chart.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+name: angularja-csti-scanner
+description: A Helm chart for the  angularja csti scanner that integrates with the secureCodeBox.
+
+type: application
+# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
+version: latest
+kubeVersion: ">=v1.11.0-0"
+
+keywords:
+  - security
+  - acstis
+  - scanner
+  - secureCodeBox
+home: https://docs.securecodebox.io/docs/scanners/angularja-csti-scanner
+icon: https://docs.securecodebox.io/img/integrationIcons/Acstis.svg
+sources:
+  - https://github.com/secureCodeBox/secureCodeBox
+maintainers:
+  - name: iteratec GmbH
+    email: secureCodeBox@iteratec.com
+
diff --git a/scanners/angularjs-csti-scanner/README.md.gotmpl b/scanners/angularjs-csti-scanner/README.md.gotmpl
new file mode 100644
index 0000000000..27a04fb410
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/README.md.gotmpl
@@ -0,0 +1,136 @@
+---
+title: "Angularjs CSTI Scanner"
+category: "scanner"
+type: "Repository"
+state: "in progress"
+usecase: "Find AngularJS websites vulnerable to template injections"
+---
+
+![acstis logo](https://rawgit.com/tijme/angularjs-csti-scanner/master/.github/logo.svg?pypi=png.from.svg)
+
+AngularJS Client-Side Template Injection Scanner (acstis) is a open source scanner for 
+finding possible template injection vulnerabilities on websites using AngularJS.
+
+For more information visit the projects github site <https://github.com/tijme/angularjs-csti-scanner>
+
+## Deployment
+
+The gitleaks scanner can be deployed with helm:
+
+```bash
+helm upgrade --install acstis secureCodeBox/acstis
+```
+
+## Scanner configuration
+
+The only mandatory parameter is:
+- `-d`: The url to scan (e.g. https://angularjs.org/).
+
+Optional arguments:
+
+```bash
+-c, --crawl                                                                      use the crawler to scan all the entire domain
+-vp, --verify-payload                                                            use a javascript engine to verify if the payload was executed (otherwise false positives may occur)
+-av ANGULAR_VERSION, --angular-version ANGULAR_VERSION                           manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work
+-vrl VULNERABLE_REQUESTS_LOG, --vulnerable-requests-log VULNERABLE_REQUESTS_LOG  log all vulnerable requests to this file (e.g. /var/logs/acstis.log or urls.log)
+-siv, --stop-if-vulnerable                                                       (crawler option) stop scanning if a vulnerability was found
+-pmm, --protocol-must-match                                                      (crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)
+-sos, --scan-other-subdomains                                                    (crawler option) also scan pages that have another subdomain than the startpoint
+-soh, --scan-other-hostnames                                                     (crawler option) also scan pages that have another hostname than the startpoint
+-sot, --scan-other-tlds                                                          (crawler option) also scan pages that have another tld than the startpoint
+-md MAX_DEPTH, --max-depth MAX_DEPTH                                             (crawler option) the maximum search depth (default is unlimited)
+-mt MAX_THREADS, --max-threads MAX_THREADS                                       (crawler option) the maximum amount of simultaneous threads to use (default is 20)
+-iic, --ignore-invalid-certificates                                              (crawler option) ignore invalid ssl certificates
+```
+
+**Do not** override the option `-vrl` or `--vulnerable-requests-log`. It is already configured for automatic findings parsing.
+
+### Request configuration
+
+Because *acstis* does not provide provide command line arguments for configuring the sent requests,
+you have to mount a config map into the scan container on a specific location. Your additional config map should be
+ mounted to `/acstis/config/acstis-config.txt`. For example create a config map:
+ 
+ ```bash
+kubectl create configmap --from-file /path/to/my/acstis-config.txt acstis-config 
+```
+ 
+ And mount it into the container:
+ 
+ ```yaml
+ volumes:
+     - name: "acstis-config"
+       configMap:
+         name: "acstis-config"
+   volumeMounts:
+     - name: "acstis-config"
+       mountPath: "/acstis/config/"
+```
+
+#### Configuration options in *acstis-config.txt*
+
+Add the following snippets to the *acstis-config.txt* file to enable further options.
+The options are python code which will be injected into the *acstis* script before execution.
+
+**Basic Authentication**
+```text
+options.identity.auth = HTTPBasicAuth("username", "password")
+```
+
+**Cookies**
+```text
+options.identity.cookies.set(name='tasty_cookie', value='yum', domain='finnwea.com', path='/cookies')
+options.identity.cookies.set(name='gross_cookie', value='blech', domain='finnwea.com', path='/elsewhere')
+```
+
+**Headers**
+```text
+options.identity.headers.update({
+    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36",
+    "Authorization": "Bearer ey3jafoe.2jefo..."
+})
+```
+
+**Proxies**
+```text
+options.identity.proxies = {
+    # No authentication
+    # 'http': 'http://host:port',
+    # 'https': 'http://host:port',
+
+    # Basic authentication
+    # 'http': 'http://user:pass@host:port',
+    # 'https': 'https://user:pass@host:port',
+
+    # SOCKS
+    'http': 'socks5://user:pass@host:port',
+    'https': 'socks5://user:pass@host:port'
+}
+```
+
+**Scope options**
+```text
+options.scope.protocol_must_match = False
+
+options.scope.subdomain_must_match = True
+
+options.scope.hostname_must_match = True
+
+options.scope.tld_must_match = True
+
+options.scope.max_depth = None
+
+options.scope.request_methods = [
+    Request.METHOD_GET,
+    Request.METHOD_POST,
+    Request.METHOD_PUT,
+    Request.METHOD_DELETE,
+    Request.METHOD_OPTIONS,
+    Request.METHOD_HEAD
+]
+```
+
+## Chart Configuration
+
+{{ template "chart.valuesTable" . }}
+
diff --git a/scanners/angularjs-csti-scanner/examples/scan-single-url/README.md b/scanners/angularjs-csti-scanner/examples/scan-single-url/README.md
new file mode 100644
index 0000000000..6e309b4ca6
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/examples/scan-single-url/README.md
@@ -0,0 +1 @@
+This example scans a single URL.
diff --git a/scanners/angularjs-csti-scanner/examples/scan-single-url/scan.yaml b/scanners/angularjs-csti-scanner/examples/scan-single-url/scan.yaml
new file mode 100644
index 0000000000..ae6c5118c4
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/examples/scan-single-url/scan.yaml
@@ -0,0 +1,9 @@
+apiVersion: "execution.securecodebox.io/v1"
+kind: Scan
+metadata:
+  name: "scan-single-url"
+spec:
+  scanType: "angularjs-csti-scanner"
+  parameters:
+    - "-d"
+    - "https://angularjs.org/"
diff --git a/scanners/angularjs-csti-scanner/examples/scan-website-with-options/README.md b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/README.md
new file mode 100644
index 0000000000..17ad8cc848
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/README.md
@@ -0,0 +1,15 @@
+To add some headers to the scanners requests create a file called *acstis-config.txt* with the following content:
+
+```text
+options.identity.headers.update({
+    "Authorization": "Bearer <JWT>"
+})
+```
+
+Then create a config map from this file:
+
+```bash
+kubectl create configmap --from-file /path/to/my/acstis-config.txt acstis-config 
+```
+
+After mounting the config map to the specified path you can execute your scan.
diff --git a/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml
new file mode 100644
index 0000000000..c88da717b3
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml
@@ -0,0 +1,20 @@
+apiVersion: "execution.securecodebox.io/v1"
+kind: Scan
+metadata:
+  name: "scan-website-with-jwt"
+spec:
+  scanType: "angularjs-csti-scanner"
+  parameters:
+    - "-d"
+    - "https://angularjs.org/"
+    - "-c"
+    # you should always specify a max depth when crawling
+    - "-md"
+    - "3"
+  volumes:
+    - name: "acstis-config"
+      configMap:
+        name: "acstis-config"
+  volumeMounts:
+    - name: "acstis-config"
+      mountPath: "/acstis/config/"
diff --git a/scanners/angularjs-csti-scanner/helm2.Chart.yaml b/scanners/angularjs-csti-scanner/helm2.Chart.yaml
new file mode 100644
index 0000000000..4cc44ac19c
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/helm2.Chart.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+name: angularja-csti-scanner
+description: A Helm chart for the  angularja csti scanner that integrates with the secureCodeBox.
+
+type: application
+# version - gets automatically set to the secureCodeBox release version when the helm charts gets published
+version: latest
+kubeVersion: ">=v1.11.0-0"
+
+keywords:
+  - security
+  - acstis
+  - scanner
+  - secureCodeBox
+home: https://docs.securecodebox.io/docs/scanners/angularja-csti-scanner
+icon: https://docs.securecodebox.io/img/integrationIcons/Acstis.svg
+sources:
+  - https://github.com/secureCodeBox/secureCodeBox
+maintainers:
+  - name: iteratec GmbH
+    email: secureCodeBox@iteratec.com
+
diff --git a/scanners/angularjs-csti-scanner/parser/Dockerfile b/scanners/angularjs-csti-scanner/parser/Dockerfile
new file mode 100644
index 0000000000..5925068437
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/parser/Dockerfile
@@ -0,0 +1,4 @@
+ARG baseImageTag
+FROM securecodebox/parser-sdk-nodejs:${baseImageTag:-latest}
+WORKDIR /home/app/parser-wrapper/parser/
+COPY --chown=app:app ./parser.js ./parser.js
diff --git a/scanners/angularjs-csti-scanner/parser/__testFiles__/acstis-test-empty-findings.txt b/scanners/angularjs-csti-scanner/parser/__testFiles__/acstis-test-empty-findings.txt
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/scanners/angularjs-csti-scanner/parser/__testFiles__/acstis-test-findings.txt b/scanners/angularjs-csti-scanner/parser/__testFiles__/acstis-test-findings.txt
new file mode 100644
index 0000000000..917b3a1009
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/parser/__testFiles__/acstis-test-findings.txt
@@ -0,0 +1,2 @@
+POST(string={{a=toString().constructor.prototype;a.charAt=a.trim;$eval('a,alert(1),a')}}): https://www.google.com/test/
+GET(category={{alert('test')}}): http://localhost:5000/home?category={{alert('test')}}
diff --git a/scanners/angularjs-csti-scanner/parser/parser.js b/scanners/angularjs-csti-scanner/parser/parser.js
new file mode 100644
index 0000000000..c4f76ac0cf
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/parser/parser.js
@@ -0,0 +1,51 @@
+async function parse(fileContent) {
+
+  if (fileContent.length === 0) {
+    return []
+  }
+
+  const lines = fileContent.split('\n')
+  lines.splice(-1, 1)
+
+  return lines.map(line => {
+    const method = parseMethod(line)
+    const url = parseUrl(line)
+    const data = parseData(line, method.length)
+    let parameter = null
+    let injectedTemplate = null
+    if (data.length > 5) {
+      parameter = data.substring(0, data.indexOf('='))
+      injectedTemplate = data.substring(data.indexOf('=') + 1)
+    }
+
+    return {
+      name: 'AngularJS template injection',
+      description: 'The given in this finding URL is vulnerable to AngularJS template injection which can lead to XSS',
+      osi_layer: 'APPLICATION',
+      severity: 'HIGH',
+      category: 'Template Injection',
+      attributes: {
+        url: url,
+        method: method,
+        parameter: parameter,
+        injectedTemplate: injectedTemplate,
+      }
+    }
+  })
+}
+
+function parseMethod(line) {
+  return line.substring(0, line.indexOf('('))
+}
+
+function parseUrl(line) {
+  console.log(line)
+  return line.match(/http[s]?:\/\/[^\n ]+/g)[0]
+}
+
+function parseData(line, start) {
+  return line.substring(start + 1, line.indexOf('): '))
+}
+
+
+module.exports.parse = parse
diff --git a/scanners/angularjs-csti-scanner/parser/parser.test.js b/scanners/angularjs-csti-scanner/parser/parser.test.js
new file mode 100644
index 0000000000..c4cfc5a4fc
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/parser/parser.test.js
@@ -0,0 +1,57 @@
+const fs = require("fs");
+const util = require("util");
+
+// eslint-disable-next-line security/detect-non-literal-fs-filename
+const readFile = util.promisify(fs.readFile);
+
+const { parse } = require("./parser");
+
+test("should properly parse acstis empty finding log file", async () => {
+  const findings = await readFile(
+    __dirname + "/__testFiles__/acstis-test-empty-findings.txt",
+    {
+      encoding: "utf8"
+    }
+  );
+  expect(await parse(findings)).toMatchInlineSnapshot(
+    'Array []');
+});
+
+test("should properly parse acstis finding log file", async () => {
+  const findings = await readFile(
+    __dirname + "/__testFiles__/acstis-test-findings.txt",
+    {
+      encoding: "utf8"
+    }
+  );
+  expect(await parse(findings)).toMatchInlineSnapshot(`
+    Array [
+      Object {
+        "attributes": Object {
+          "injectedTemplate": "{{a=toString().constructor.prototype;a.charAt=a.trim;$eval('a,alert(1),a')}}",
+          "method": "POST",
+          "parameter": "string",
+          "url": "https://www.google.com/test/",
+        },
+        "category": "Template Injection",
+        "description": "The given in this finding URL is vulnerable to AngularJS template injection which can lead to XSS",
+        "name": "AngularJS template injection",
+        "osi_layer": "APPLICATION",
+        "severity": "HIGH",
+      },
+      Object {
+        "attributes": Object {
+          "injectedTemplate": "{{alert('test')}}",
+          "method": "GET",
+          "parameter": "category",
+          "url": "http://localhost:5000/home?category={{alert('test')}}",
+        },
+        "category": "Template Injection",
+        "description": "The given in this finding URL is vulnerable to AngularJS template injection which can lead to XSS",
+        "name": "AngularJS template injection",
+        "osi_layer": "APPLICATION",
+        "severity": "HIGH",
+      },
+    ]
+  `);
+});
diff --git a/scanners/angularjs-csti-scanner/scanner/Dockerfile b/scanners/angularjs-csti-scanner/scanner/Dockerfile
new file mode 100644
index 0000000000..83097fc0cc
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/scanner/Dockerfile
@@ -0,0 +1,6 @@
+FROM python:3.6-alpine
+COPY acstis-script.py /acstis/acstis-script.py
+COPY wrapper.sh /wrapper.sh
+RUN apk add --update --no-cache g++ gcc libxslt-dev
+RUN pip install https://github.com/tijme/angularjs-csti-scanner/archive/master.zip
+ENTRYPOINT [ "sh", "/wrapper.sh" ]
diff --git a/scanners/angularjs-csti-scanner/scanner/acstis-script.py b/scanners/angularjs-csti-scanner/scanner/acstis-script.py
new file mode 100644
index 0000000000..4d0d5261bb
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/scanner/acstis-script.py
@@ -0,0 +1,150 @@
+# -*- coding: utf-8 -*-
+
+# MIT License
+#
+# Copyright (c) 2017 Tijme Gommers
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+import argparse
+import colorlog
+import logging
+
+from nyawc.Options import Options
+from acstis.Driver import Driver
+from acstis.helpers.PackageHelper import PackageHelper
+
+from requests.auth import HTTPBasicAuth
+from nyawc.http.Request import Request
+
+def main():
+    """Start the scanner."""
+
+    print_banner()
+    setup_logger()
+
+    args = require_arguments()
+
+    options = Options()
+
+    options.scope.protocol_must_match = args.protocol_must_match
+    options.scope.subdomain_must_match = not args.scan_other_subdomains
+    options.scope.hostname_must_match = not args.scan_other_hostnames
+    options.scope.tld_must_match = not args.scan_other_tlds
+    options.scope.max_depth = args.max_depth if args.crawl else 0
+    options.performance.max_threads = args.max_threads
+    options.misc.verify_ssl_certificates = not args.ignore_invalid_certificates
+    options.misc.trusted_certificates = args.trusted_certificates
+
+    #INSERT CUSTOM OPTIONS HERE
+
+
+    driver = Driver(args, options)
+    driver.start()
+
+def require_arguments():
+    """Get the arguments from CLI input.
+    Returns:
+        :class:`argparse.Namespace`: A namespace with all the parsed CLI arguments.
+    """
+
+    parser = argparse.ArgumentParser(
+        prog=PackageHelper.get_alias(),
+        formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=180, width=180)
+    )
+
+    optional = parser._action_groups.pop()
+    required = parser.add_argument_group("required arguments")
+
+    required.add_argument("-d", "--domain", help="the domain to scan (e.g. finnwea.com)", required=True)
+
+    optional.add_argument("-c", "--crawl", help="use the crawler to scan all the entire domain", action="store_true")
+    optional.add_argument("-vp", "--verify-payload", help="use a javascript engine to verify if the payload was executed (otherwise false positives may occur)", action="store_true")
+    optional.add_argument("-av", "--angular-version", help="manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work", type=str, default=None)
+    optional.add_argument("-vrl", "--vulnerable-requests-log", help="log all vulnerable requests to this file (e.g. /var/logs/acstis.log or urls.log)", type=str, default=None)
+    optional.add_argument("-siv", "--stop-if-vulnerable", help="(crawler option) stop scanning if a vulnerability was found", action="store_true")
+    optional.add_argument("-pmm", "--protocol-must-match", help="(crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)", action="store_true")
+    optional.add_argument("-sos", "--scan-other-subdomains", help="(crawler option) also scan pages that have another subdomain than the startpoint", action="store_true")
+    optional.add_argument("-soh", "--scan-other-hostnames", help="(crawler option) also scan pages that have another hostname than the startpoint", action="store_true")
+    optional.add_argument("-sot", "--scan-other-tlds", help="(crawler option) also scan pages that have another tld than the startpoint", action="store_true")
+    optional.add_argument("-md", "--max-depth", help="(crawler option) the maximum search depth (default is unlimited)", type=int)
+    optional.add_argument("-mt", "--max-threads", help="(crawler option) the maximum amount of simultaneous threads to use (default is 20)", type=int, default=20)
+    optional.add_argument("-iic", "--ignore-invalid-certificates", help="(crawler option) ignore invalid ssl certificates", action="store_true")
+    optional.add_argument("-tc", "--trusted-certificates", help="(crawler option) trust this CA_BUNDLE file (.pem) or directory with certificates", type=str, default=None)
+
+    parser._action_groups.append(optional)
+    return parser.parse_args()
+
+def setup_logger():
+    """Setup ColorLog to enable colored logging output."""
+
+    # Colored logging
+    handler = colorlog.StreamHandler()
+    handler.setFormatter(colorlog.ColoredFormatter(
+        "%(log_color)s[%(levelname)s] %(message)s",
+        log_colors={
+            "DEBUG": "cyan",
+            "INFO": "white",
+            "SUCCESS": "green",
+            "WARNING": "yellow",
+            "ERROR": "red",
+            "CRITICAL": "red,bg_white"
+        }
+    ))
+
+    logger = colorlog.getLogger()
+    logger.addHandler(handler)
+
+    # Also show INFO logs
+    logger.setLevel(logging.INFO)
+
+    # Add SUCCESS logging
+    logging.SUCCESS = 25
+    logging.addLevelName(
+        logging.SUCCESS,
+        "SUCCESS"
+    )
+
+    # Disable Selenium logging
+    selenium_logger = logging.getLogger("selenium.webdriver.remote.remote_connection")
+    selenium_logger.setLevel(logging.WARNING)
+
+    setattr(
+        logger,
+        "success",
+        lambda message, *args: logger._log(logging.SUCCESS, message, args)
+    )
+
+def print_banner():
+    """Print a useless ASCII art banner to make things look a bit nicer."""
+
+    print("""
+  /$$$$$$   /$$$$$$   /$$$$$$  /$$$$$$$$ /$$$$$$  /$$$$$$
+ /$$__  $$ /$$__  $$ /$$__  $$|__  $$__/|_  $$_/ /$$__  $$
+| $$  \ $$| $$  \__/| $$  \__/   | $$     | $$  | $$  \__/
+| $$$$$$$$| $$      |  $$$$$$    | $$     | $$  |  $$$$$$
+| $$__  $$| $$       \____  $$   | $$     | $$   \____  $$
+| $$  | $$| $$    $$ /$$  \ $$   | $$     | $$   /$$  \ $$
+| $$  | $$|  $$$$$$/|  $$$$$$/   | $$    /$$$$$$|  $$$$$$/
+|__/  |__/ \______/  \______/    |__/   |______/ \______/
+Version """ + PackageHelper.get_version() + """ - Copyright 2017 Tijme Gommers <tijme@finnwea.com>
+    """)
+
+if __name__ == "__main__":
+    main()
diff --git a/scanners/angularjs-csti-scanner/scanner/wrapper.sh b/scanners/angularjs-csti-scanner/scanner/wrapper.sh
new file mode 100644
index 0000000000..f5fbe5ce1c
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/scanner/wrapper.sh
@@ -0,0 +1,14 @@
+# If acstis config exists paste it into the acstis script
+if [ -f /acstis/config/acstis-config.txt ]; then
+  echo "Insert acstis-config file into acstis script"
+  awk '{$1=$1}1' /acstis/config/acstis-config.txt | # Trim start end end spaces of each line of the config
+  awk -v x=4 '{printf "%" x "s%s\n", "", $0}' | # Add indentation of 4 to every line
+  sed -i '/#INSERT CUSTOM OPTIONS HERE/ r /dev/stdin' /acstis/acstis-script.py # Insert config into script
+fi
+python /acstis/acstis-script.py $@
+
+# If no finding occured generate a empty file for the lurcher
+if [ ! -f /home/securecodebox/findings.log ]; then
+    touch /home/securecodebox/findings.log
+fi
+exit 0
diff --git a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-parse-definition.yaml b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-parse-definition.yaml
new file mode 100644
index 0000000000..a9b00640ba
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-parse-definition.yaml
@@ -0,0 +1,8 @@
+apiVersion: "execution.securecodebox.io/v1"
+kind: ParseDefinition
+metadata:
+  name: "acstis-log"
+spec:
+  handlesResultsType: acstis-log
+  image: "{{ .Values.parserImage.repository }}:{{ .Values.parserImage.tag | default .Chart.Version }}"
+  ttlSecondsAfterFinished: {{ .Values.parseJob.ttlSecondsAfterFinished }}
diff --git a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml
new file mode 100644
index 0000000000..45da7fdf10
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml
@@ -0,0 +1,36 @@
+apiVersion: "execution.securecodebox.io/v1"
+kind: ScanType
+metadata:
+  name: "angularjs-csti-scanner"
+spec:
+  extractResults:
+    type: acstis-log
+    location: "/home/securecodebox/findings.log"
+  jobTemplate:
+    spec:
+      {{- if .Values.scannerJob.ttlSecondsAfterFinished }}
+      ttlSecondsAfterFinished: {{ .Values.scannerJob.ttlSecondsAfterFinished }}
+      {{- end }}
+      backoffLimit: 3
+      template:
+        spec:
+          restartPolicy: OnFailure
+          containers:
+            - name: acstis-scanner
+              image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
+              command:
+                - "-vrl"
+                - "/home/securecodebox/findings.log"
+              resources:
+                {{- toYaml .Values.scannerJob.resources | nindent 16 }}
+              securityContext:
+                {{- toYaml .Values.scannerJob.securityContext | nindent 16 }}
+              env:
+                {{- toYaml .Values.scannerJob.env | nindent 16 }}
+              volumeMounts:
+                {{- toYaml .Values.scannerJob.extraVolumeMounts | nindent 16 }}
+            {{- if .Values.scannerJob.extraContainers }}
+            {{- toYaml .Values.scannerJob.extraContainers | nindent 12 }}
+            {{- end }}
+          volumes:
+            {{- toYaml .Values.scannerJob.extraVolumes | nindent 12 }}
diff --git a/scanners/angularjs-csti-scanner/values.yaml b/scanners/angularjs-csti-scanner/values.yaml
new file mode 100644
index 0000000000..4bb11145b4
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/values.yaml
@@ -0,0 +1,46 @@
+image:
+  # image.repository -- Container Image to run the scan
+  repository: docker.io/securecodebox/scanner-acstis
+  # image.tag -- defaults to the charts version
+  tag: null
+
+parserImage:
+  # parserImage.tag - defaults to the charts version
+  # parserImage.repository -- Parser image repository
+  repository: docker.io/securecodebox/parser-acstis
+  # parserImage.tag -- Parser image tag
+  # @default -- defaults to the charts version
+  tag: null
+
+parseJob:
+  # parseJob.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
+  ttlSecondsAfterFinished: null
+
+scannerJob:
+# scannerJob.ttlSecondsAfterFinished -- seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
+  ttlSecondsAfterFinished: null
+
+  # scannerJob.resources -- CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
+  resources: {}
+  #   resources:
+  #     requests:
+  #       memory: "256Mi"
+  #       cpu: "250m"
+  #     limits:
+  #       memory: "512Mi"
+  #       cpu: "500m"
+
+  # scannerJob.env -- Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
+  env: []
+
+  # scannerJob.extraVolumes -- Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
+  extraVolumes: []
+
+  # scannerJob.extraVolumeMounts -- Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
+  extraVolumeMounts: []
+
+  # scannerJob.extraContainers -- Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
+  extraContainers: []
+
+  # scannerJob.securityContext -- Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+  securityContext: {}

From bd836795da882572a4f57debbf8e035a5a2c0e37 Mon Sep 17 00:00:00 2001
From: paulschmelzer <paulschmelzer@users.noreply.github.com>
Date: Mon, 14 Dec 2020 14:20:33 +0000
Subject: [PATCH 02/12] Updating Helm Docs

---
 scanners/angularjs-csti-scanner/README.md | 149 ++++++++++++++++++++++
 1 file changed, 149 insertions(+)
 create mode 100644 scanners/angularjs-csti-scanner/README.md

diff --git a/scanners/angularjs-csti-scanner/README.md b/scanners/angularjs-csti-scanner/README.md
new file mode 100644
index 0000000000..94e89aeadb
--- /dev/null
+++ b/scanners/angularjs-csti-scanner/README.md
@@ -0,0 +1,149 @@
+---
+title: "Angularjs CSTI Scanner"
+category: "scanner"
+type: "Repository"
+state: "in progress"
+usecase: "Find AngularJS websites vulnerable to template injections"
+---
+
+![acstis logo](https://rawgit.com/tijme/angularjs-csti-scanner/master/.github/logo.svg?pypi=png.from.svg)
+
+AngularJS Client-Side Template Injection Scanner (acstis) is a open source scanner for
+finding possible template injection vulnerabilities on websites using AngularJS.
+
+For more information visit the projects github site <https://github.com/tijme/angularjs-csti-scanner>
+
+## Deployment
+
+The gitleaks scanner can be deployed with helm:
+
+```bash
+helm upgrade --install acstis secureCodeBox/acstis
+```
+
+## Scanner configuration
+
+The only mandatory parameter is:
+- `-d`: The url to scan (e.g. https://angularjs.org/).
+
+Optional arguments:
+
+```bash
+-c, --crawl                                                                      use the crawler to scan all the entire domain
+-vp, --verify-payload                                                            use a javascript engine to verify if the payload was executed (otherwise false positives may occur)
+-av ANGULAR_VERSION, --angular-version ANGULAR_VERSION                           manually pass the angular version (e.g. 1.4.2) if the automatic check doesn't work
+-vrl VULNERABLE_REQUESTS_LOG, --vulnerable-requests-log VULNERABLE_REQUESTS_LOG  log all vulnerable requests to this file (e.g. /var/logs/acstis.log or urls.log)
+-siv, --stop-if-vulnerable                                                       (crawler option) stop scanning if a vulnerability was found
+-pmm, --protocol-must-match                                                      (crawler option) only scan pages with the same protocol as the startpoint (e.g. only https)
+-sos, --scan-other-subdomains                                                    (crawler option) also scan pages that have another subdomain than the startpoint
+-soh, --scan-other-hostnames                                                     (crawler option) also scan pages that have another hostname than the startpoint
+-sot, --scan-other-tlds                                                          (crawler option) also scan pages that have another tld than the startpoint
+-md MAX_DEPTH, --max-depth MAX_DEPTH                                             (crawler option) the maximum search depth (default is unlimited)
+-mt MAX_THREADS, --max-threads MAX_THREADS                                       (crawler option) the maximum amount of simultaneous threads to use (default is 20)
+-iic, --ignore-invalid-certificates                                              (crawler option) ignore invalid ssl certificates
+```
+
+**Do not** override the option `-vrl` or `--vulnerable-requests-log`. It is already configured for automatic findings parsing.
+
+### Request configuration
+
+Because *acstis* does not provide provide command line arguments for configuring the sent requests,
+you have to mount a config map into the scan container on a specific location. Your additional config map should be
+ mounted to `/acstis/config/acstis-config.txt`. For example create a config map:
+
+ ```bash
+kubectl create configmap --from-file /path/to/my/acstis-config.txt acstis-config
+```
+
+ And mount it into the container:
+
+ ```yaml
+ volumes:
+     - name: "acstis-config"
+       configMap:
+         name: "acstis-config"
+   volumeMounts:
+     - name: "acstis-config"
+       mountPath: "/acstis/config/"
+```
+
+#### Configuration options in *acstis-config.txt*
+
+Add the following snippets to the *acstis-config.txt* file to enable further options.
+The options are python code which will be injected into the *acstis* script before execution.
+
+**Basic Authentication**
+```text
+options.identity.auth = HTTPBasicAuth("username", "password")
+```
+
+**Cookies**
+```text
+options.identity.cookies.set(name='tasty_cookie', value='yum', domain='finnwea.com', path='/cookies')
+options.identity.cookies.set(name='gross_cookie', value='blech', domain='finnwea.com', path='/elsewhere')
+```
+
+**Headers**
+```text
+options.identity.headers.update({
+    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36",
+    "Authorization": "Bearer ey3jafoe.2jefo..."
+})
+```
+
+**Proxies**
+```text
+options.identity.proxies = {
+    # No authentication
+    # 'http': 'http://host:port',
+    # 'https': 'http://host:port',
+
+    # Basic authentication
+    # 'http': 'http://user:pass@host:port',
+    # 'https': 'https://user:pass@host:port',
+
+    # SOCKS
+    'http': 'socks5://user:pass@host:port',
+    'https': 'socks5://user:pass@host:port'
+}
+```
+
+**Scope options**
+```text
+options.scope.protocol_must_match = False
+
+options.scope.subdomain_must_match = True
+
+options.scope.hostname_must_match = True
+
+options.scope.tld_must_match = True
+
+options.scope.max_depth = None
+
+options.scope.request_methods = [
+    Request.METHOD_GET,
+    Request.METHOD_POST,
+    Request.METHOD_PUT,
+    Request.METHOD_DELETE,
+    Request.METHOD_OPTIONS,
+    Request.METHOD_HEAD
+]
+```
+
+## Chart Configuration
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| image.repository | string | `"docker.io/securecodebox/scanner-acstis"` | Container Image to run the scan |
+| image.tag | string | `nil` | defaults to the charts version |
+| parseJob.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
+| parserImage.repository | string | `"docker.io/securecodebox/parser-acstis"` | Parser image repository |
+| parserImage.tag | string | defaults to the charts version | Parser image tag |
+| scannerJob.env | list | `[]` | Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) |
+| scannerJob.extraContainers | list | `[]` | Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) |
+| scannerJob.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
+| scannerJob.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
+| scannerJob.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
+| scannerJob.securityContext | object | `{}` | Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) |
+| scannerJob.ttlSecondsAfterFinished | string | `nil` | seconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
+

From d75af99038e0771d3d5d41107d7827e702eb9ff7 Mon Sep 17 00:00:00 2001
From: Paul <paul.schmelzer@iteratec.com>
Date: Mon, 21 Dec 2020 13:38:55 +0100
Subject: [PATCH 03/12] Finalize PR

---
 .github/workflows/ci.yaml                      | 18 ++++++++++++++++++
 .../angularjs-csti-scanner/README.md.gotmpl    |  8 ++++----
 .../examples/scan-single-url/scan.yaml         |  2 +-
 .../scan-website-with-options/README.md        |  4 ++--
 .../scan-website-with-options/scan.yaml        |  2 +-
 .../angularjs-csti-scanner/scanner/wrapper.sh  |  4 ++--
 .../angularjs-csti-scanner-scan-type.yaml      |  2 ++
 7 files changed, 30 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 04b9200731..63bb50f8d7 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -134,6 +134,16 @@ jobs:
           tag_with_ref: true
           tag_with_sha: true
           build_args: baseImageTag=ci-local
+      - uses: docker/build-push-action@v1
+        name: "Build & Push AngularJS CSTI Parser Image"
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: securecodebox/parser-acstis
+          path: ./scanners/angularjs-csti-scanner/parser/
+          tag_with_ref: true
+          tag_with_sha: true
+          build_args: baseImageTag=ci-local
       - uses: docker/build-push-action@v1
         name: "Build & Push Git-Repo-Scanner Parser Image"
         with:
@@ -371,6 +381,14 @@ jobs:
           path: ./scanners/git-repo-scanner/scanner/
           tags: "latest"
           tag_with_ref: true
+      - uses: docker/build-push-action@v1
+        name: "Build & Push AngularJS CSTI Scanner Image"
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: securecodebox/scanner-acstis
+          path: ./scanners/angularjs-csti-scanner/scanner/
+          tags: "3.0.6,latest"
       - uses: docker/build-push-action@v1
         name: "Build & Push Ncrack Scanner Image"
         with:
diff --git a/scanners/angularjs-csti-scanner/README.md.gotmpl b/scanners/angularjs-csti-scanner/README.md.gotmpl
index 27a04fb410..d397cf5a48 100644
--- a/scanners/angularjs-csti-scanner/README.md.gotmpl
+++ b/scanners/angularjs-csti-scanner/README.md.gotmpl
@@ -49,10 +49,10 @@ Optional arguments:
 
 Because *acstis* does not provide provide command line arguments for configuring the sent requests,
 you have to mount a config map into the scan container on a specific location. Your additional config map should be
- mounted to `/acstis/config/acstis-config.txt`. For example create a config map:
+ mounted to `/acstis/config/acstis-config.py`. For example create a config map:
  
  ```bash
-kubectl create configmap --from-file /path/to/my/acstis-config.txt acstis-config 
+kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config 
 ```
  
  And mount it into the container:
@@ -67,9 +67,9 @@ kubectl create configmap --from-file /path/to/my/acstis-config.txt acstis-config
        mountPath: "/acstis/config/"
 ```
 
-#### Configuration options in *acstis-config.txt*
+#### Configuration options in *acstis-config.py*
 
-Add the following snippets to the *acstis-config.txt* file to enable further options.
+Add the following snippets to the *acstis-config.py* file to enable further options.
 The options are python code which will be injected into the *acstis* script before execution.
 
 **Basic Authentication**
diff --git a/scanners/angularjs-csti-scanner/examples/scan-single-url/scan.yaml b/scanners/angularjs-csti-scanner/examples/scan-single-url/scan.yaml
index ae6c5118c4..88154ce53e 100644
--- a/scanners/angularjs-csti-scanner/examples/scan-single-url/scan.yaml
+++ b/scanners/angularjs-csti-scanner/examples/scan-single-url/scan.yaml
@@ -6,4 +6,4 @@ spec:
   scanType: "angularjs-csti-scanner"
   parameters:
     - "-d"
-    - "https://angularjs.org/"
+    - "https://example.com"
diff --git a/scanners/angularjs-csti-scanner/examples/scan-website-with-options/README.md b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/README.md
index 17ad8cc848..0486823f75 100644
--- a/scanners/angularjs-csti-scanner/examples/scan-website-with-options/README.md
+++ b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/README.md
@@ -1,4 +1,4 @@
-To add some headers to the scanners requests create a file called *acstis-config.txt* with the following content:
+To add some headers to the scanners requests create a file called *acstis-config.py* with the following content:
 
 ```text
 options.identity.headers.update({
@@ -9,7 +9,7 @@ options.identity.headers.update({
 Then create a config map from this file:
 
 ```bash
-kubectl create configmap --from-file /path/to/my/acstis-config.txt acstis-config 
+kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config 
 ```
 
 After mounting the config map to the specified path you can execute your scan.
diff --git a/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml
index c88da717b3..a68335cec0 100644
--- a/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml
+++ b/scanners/angularjs-csti-scanner/examples/scan-website-with-options/scan.yaml
@@ -6,7 +6,7 @@ spec:
   scanType: "angularjs-csti-scanner"
   parameters:
     - "-d"
-    - "https://angularjs.org/"
+    - "https://example.com"
     - "-c"
     # you should always specify a max depth when crawling
     - "-md"
diff --git a/scanners/angularjs-csti-scanner/scanner/wrapper.sh b/scanners/angularjs-csti-scanner/scanner/wrapper.sh
index f5fbe5ce1c..9d1602a960 100644
--- a/scanners/angularjs-csti-scanner/scanner/wrapper.sh
+++ b/scanners/angularjs-csti-scanner/scanner/wrapper.sh
@@ -1,7 +1,7 @@
 # If acstis config exists paste it into the acstis script
-if [ -f /acstis/config/acstis-config.txt ]; then
+if [ -f /acstis/config/acstis-config.py ]; then
   echo "Insert acstis-config file into acstis script"
-  awk '{$1=$1}1' /acstis/config/acstis-config.txt | # Trim start end end spaces of each line of the config
+  awk '{$1=$1}1' /acstis/config/acstis-config.py | # Trim start end end spaces of each line of the config
   awk -v x=4 '{printf "%" x "s%s\n", "", $0}' | # Add indentation of 4 to every line
   sed -i '/#INSERT CUSTOM OPTIONS HERE/ r /dev/stdin' /acstis/acstis-script.py # Insert config into script
 fi
diff --git a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml
index 45da7fdf10..9b44b70cdf 100644
--- a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml
+++ b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml
@@ -19,6 +19,8 @@ spec:
             - name: acstis-scanner
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
               command:
+                - "sh"
+                - "/wrapper.sh"
                 - "-vrl"
                 - "/home/securecodebox/findings.log"
               resources:

From 8f6c10a139780ed72df7b6c73ac058317efa12a3 Mon Sep 17 00:00:00 2001
From: paulschmelzer <paulschmelzer@users.noreply.github.com>
Date: Mon, 21 Dec 2020 12:39:39 +0000
Subject: [PATCH 04/12] Updating Helm Docs

---
 scanners/angularjs-csti-scanner/README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/scanners/angularjs-csti-scanner/README.md b/scanners/angularjs-csti-scanner/README.md
index 94e89aeadb..c7eeefa98a 100644
--- a/scanners/angularjs-csti-scanner/README.md
+++ b/scanners/angularjs-csti-scanner/README.md
@@ -49,10 +49,10 @@ Optional arguments:
 
 Because *acstis* does not provide provide command line arguments for configuring the sent requests,
 you have to mount a config map into the scan container on a specific location. Your additional config map should be
- mounted to `/acstis/config/acstis-config.txt`. For example create a config map:
+ mounted to `/acstis/config/acstis-config.py`. For example create a config map:
 
  ```bash
-kubectl create configmap --from-file /path/to/my/acstis-config.txt acstis-config
+kubectl create configmap --from-file /path/to/my/acstis-config.py acstis-config
 ```
 
  And mount it into the container:
@@ -67,9 +67,9 @@ kubectl create configmap --from-file /path/to/my/acstis-config.txt acstis-config
        mountPath: "/acstis/config/"
 ```
 
-#### Configuration options in *acstis-config.txt*
+#### Configuration options in *acstis-config.py*
 
-Add the following snippets to the *acstis-config.txt* file to enable further options.
+Add the following snippets to the *acstis-config.py* file to enable further options.
 The options are python code which will be injected into the *acstis* script before execution.
 
 **Basic Authentication**

From 0856d49d57d6e67061c8a7c65052a329e49f556f Mon Sep 17 00:00:00 2001
From: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
Date: Mon, 1 Feb 2021 12:42:09 +0100
Subject: [PATCH 05/12] Add Newline To Make GitHub Happy

Signed-off-by: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
---
 scanners/angularjs-csti-scanner/.helmignore | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scanners/angularjs-csti-scanner/.helmignore b/scanners/angularjs-csti-scanner/.helmignore
index 2b6e53d709..bfc32a880c 100644
--- a/scanners/angularjs-csti-scanner/.helmignore
+++ b/scanners/angularjs-csti-scanner/.helmignore
@@ -2,4 +2,5 @@
 
 parser/
 scanner/
-examples/
\ No newline at end of file
+examples/
+

From 956794712b8d334f5057f67568d9865318013f18 Mon Sep 17 00:00:00 2001
From: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
Date: Mon, 1 Feb 2021 12:46:26 +0100
Subject: [PATCH 06/12] Pin Angular-CSTI Scanner To Version 3.0.6

Signed-off-by: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
---
 .github/workflows/ci.yaml                          | 1 +
 scanners/angularjs-csti-scanner/scanner/Dockerfile | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 63bb50f8d7..59f8d53642 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -389,6 +389,7 @@ jobs:
           repository: securecodebox/scanner-acstis
           path: ./scanners/angularjs-csti-scanner/scanner/
           tags: "3.0.6,latest"
+          build_args: scannerVersion=3.0.6
       - uses: docker/build-push-action@v1
         name: "Build & Push Ncrack Scanner Image"
         with:
diff --git a/scanners/angularjs-csti-scanner/scanner/Dockerfile b/scanners/angularjs-csti-scanner/scanner/Dockerfile
index 83097fc0cc..ef2cf03b74 100644
--- a/scanners/angularjs-csti-scanner/scanner/Dockerfile
+++ b/scanners/angularjs-csti-scanner/scanner/Dockerfile
@@ -1,6 +1,7 @@
 FROM python:3.6-alpine
+ARG scannerVersion
 COPY acstis-script.py /acstis/acstis-script.py
 COPY wrapper.sh /wrapper.sh
 RUN apk add --update --no-cache g++ gcc libxslt-dev
-RUN pip install https://github.com/tijme/angularjs-csti-scanner/archive/master.zip
+RUN pip install https://github.com/tijme/angularjs-csti-scanner/archive/$scannerVersion.zip
 ENTRYPOINT [ "sh", "/wrapper.sh" ]

From 263e4137dc6f6bb0431ca4199baee6f811999590 Mon Sep 17 00:00:00 2001
From: Jannik Hollenbach <jannik.hollenbach@iteratec.com>
Date: Wed, 20 Jan 2021 10:52:16 +0100
Subject: [PATCH 07/12] Ensure that kubeaudit is build with the intended
 version

---
 .github/workflows/ci.yaml             | 1 +
 scanners/kubeaudit/scanner/Dockerfile | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 59f8d53642..4aeec73828 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -449,6 +449,7 @@ jobs:
           repository: securecodebox/scanner-kubeaudit
           path: ./scanners/kubeaudit/scanner/
           tags: "v0.11.5,latest"
+          build_args: "version=v0.11.5"
       - uses: docker/build-push-action@v1
         name: "Build & Push test-scan Scanner Image"
         with:
diff --git a/scanners/kubeaudit/scanner/Dockerfile b/scanners/kubeaudit/scanner/Dockerfile
index dc5d5c51b1..f72169e955 100644
--- a/scanners/kubeaudit/scanner/Dockerfile
+++ b/scanners/kubeaudit/scanner/Dockerfile
@@ -6,7 +6,8 @@ ENV CGO_ENABLED=0 GOOS=linux GOARCH=amd64
 # this is where we build our app
 WORKDIR /go/src/app/
 
-RUN git clone https://github.com/Shopify/kubeaudit.git /go/src/app/
+ARG version
+RUN git clone --depth 1 --branch $version https://github.com/Shopify/kubeaudit.git /go/src/app/
 RUN go mod download
 
 RUN go build -a -ldflags '-w -s -extldflags "-static"' -o /go/bin/kubeaudit ./cmd/ \

From 9490dea8403eedc13ecffdeb9784bf919d2fe32e Mon Sep 17 00:00:00 2001
From: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
Date: Mon, 8 Mar 2021 08:44:53 +0100
Subject: [PATCH 08/12] Add Angularjs-csti-scanner to CI

Signed-off-by: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
---
 .github/workflows/ci.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 82bcbef0e4..049d35b194 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -260,6 +260,7 @@ jobs:
       matrix:
         parser:
           - amass
+          - angularjs-csti-scanner
           - git-repo-scanner
           - gitleaks
           - kube-hunter

From 2a7164afc97f439b2985c60c8e0548908a361ba3 Mon Sep 17 00:00:00 2001
From: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
Date: Mon, 8 Mar 2021 09:04:35 +0100
Subject: [PATCH 09/12] Add Angular-csti-scanner Image Build To CI

Signed-off-by: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
---
 .github/workflows/ci.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 049d35b194..035b1f0177 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -205,6 +205,7 @@ jobs:
     strategy:
       matrix:
         hook:
+          - angularjs-csti-scanner
           - declarative-subsequent-scans
           - finding-post-processing
           - generic-webhook

From ef7e45c3f137948550860dcd5961a0ffc25755eb Mon Sep 17 00:00:00 2001
From: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
Date: Mon, 8 Mar 2021 09:28:19 +0100
Subject: [PATCH 10/12] Fix Image Build for Angularjs-csti-scanner

Signed-off-by: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 035b1f0177..65bc690705 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -205,7 +205,6 @@ jobs:
     strategy:
       matrix:
         hook:
-          - angularjs-csti-scanner
           - declarative-subsequent-scans
           - finding-post-processing
           - generic-webhook
@@ -334,6 +333,7 @@ jobs:
     strategy:
       matrix:
         scanner:
+          - angularjs-csti-scanner
           - gitleaks
           - kube-hunter
           - kubeaudit

From ae62cb1d7fbd14604039ef4ed179c36652b60dd2 Mon Sep 17 00:00:00 2001
From: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
Date: Mon, 8 Mar 2021 09:40:58 +0100
Subject: [PATCH 11/12] Pin Angularjs-csti-scanner Version in appVersion

Signed-off-by: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
---
 scanners/angularjs-csti-scanner/Chart.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scanners/angularjs-csti-scanner/Chart.yaml b/scanners/angularjs-csti-scanner/Chart.yaml
index 4cc44ac19c..3387cc2cd1 100644
--- a/scanners/angularjs-csti-scanner/Chart.yaml
+++ b/scanners/angularjs-csti-scanner/Chart.yaml
@@ -5,6 +5,7 @@ description: A Helm chart for the  angularja csti scanner that integrates with t
 type: application
 # version - gets automatically set to the secureCodeBox release version when the helm charts gets published
 version: latest
+appVersion: 3.0.6
 kubeVersion: ">=v1.11.0-0"
 
 keywords:

From 6e1bad49e938bc3f38b7d14d27ae1ecd102ac007 Mon Sep 17 00:00:00 2001
From: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
Date: Mon, 8 Mar 2021 09:42:47 +0100
Subject: [PATCH 12/12] Default to  appVersion for Angularjs-csti-scanner

Signed-off-by: Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
---
 .../templates/angularjs-csti-scanner-scan-type.yaml             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml
index 9b44b70cdf..a71ab18406 100644
--- a/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml
+++ b/scanners/angularjs-csti-scanner/templates/angularjs-csti-scanner-scan-type.yaml
@@ -17,7 +17,7 @@ spec:
           restartPolicy: OnFailure
           containers:
             - name: acstis-scanner
-              image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"
+              image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.appVersion }}"
               command:
                 - "sh"
                 - "/wrapper.sh"