secureCodeBox
diff --git a/.github/workflows/release-build.yaml b/.github/workflows/release-build.yaml
@@ -370,6 +370,7 @@ jobs:
           - sslyze
           - typo3scan
           - whatweb
+          - wpscan
 
     steps:
       - name: Checkout

diff --git a/scanners/wpscan/Makefile b/scanners/wpscan/Makefile
@@ -7,6 +7,7 @@
 
 include_guard = set
 scanner = wpscan
+custom_scanner = set
 
 include ../../scanners.mk
 

diff --git a/scanners/wpscan/README.md b/scanners/wpscan/README.md
@@ -119,7 +119,7 @@ Kubernetes: `>=v1.11.0-0`
 | scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
 | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
 | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
-| scanner.image.repository | string | `"wpscanteam/wpscan"` | Container Image to run the scan |
+| scanner.image.repository | string | `"docker.io/securecodebox/scanner-wpscan"` | Container Image to run the scan |
 | scanner.image.tag | string | `nil` | defaults to the charts appVersion |
 | scanner.nameAppend | string | `nil` | append a string to the default scantype name. |
 | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |

diff --git a/scanners/wpscan/docs/README.ArtifactHub.md b/scanners/wpscan/docs/README.ArtifactHub.md
@@ -124,7 +124,7 @@ Kubernetes: `>=v1.11.0-0`
 | scanner.extraVolumeMounts | list | `[]` | Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
 | scanner.extraVolumes | list | `[]` | Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/) |
 | scanner.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images |
-| scanner.image.repository | string | `"wpscanteam/wpscan"` | Container Image to run the scan |
+| scanner.image.repository | string | `"docker.io/securecodebox/scanner-wpscan"` | Container Image to run the scan |
 | scanner.image.tag | string | `nil` | defaults to the charts appVersion |
 | scanner.nameAppend | string | `nil` | append a string to the default scantype name. |
 | scanner.resources | object | `{}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |

diff --git a/scanners/wpscan/docs/README.DockerHub-Scanner.md b/scanners/wpscan/docs/README.DockerHub-Scanner.md
@@ -0,0 +1,130 @@
+<!--
+SPDX-FileCopyrightText: the secureCodeBox authors
+
+SPDX-License-Identifier: Apache-2.0
+-->
+<!--
+.: IMPORTANT! :.
+--------------------------
+This file is generated automatically with `helm-docs` based on the following template files:
+- ./.helm-docs/templates.gotmpl (general template data for all charts)
+- ./chart-folder/.helm-docs.gotmpl (chart specific template data)
+
+Please be aware of that and apply your changes only within those template files instead of this file.
+Otherwise your changes will be reverted/overwritten automatically due to the build process `./.github/workflows/helm-docs.yaml`
+--------------------------
+-->
+
+<p align="center">
+  <a href="https://opensource.org/licenses/Apache-2.0"><img alt="License Apache-2.0" src="https://img.shields.io/badge/License-Apache%202.0-blue.svg"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/releases/latest"><img alt="GitHub release (latest SemVer)" src="https://img.shields.io/github/v/release/secureCodeBox/secureCodeBox?sort=semver"/></a>
+  <a href="https://owasp.org/www-project-securecodebox/"><img alt="OWASP Lab Project" src="https://img.shields.io/badge/OWASP-Lab%20Project-yellow"/></a>
+  <a href="https://artifacthub.io/packages/search?repo=securecodebox"><img alt="Artifact HUB" src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/securecodebox"/></a>
+  <a href="https://github.com/secureCodeBox/secureCodeBox/"><img alt="GitHub Repo stars" src="https://img.shields.io/github/stars/secureCodeBox/secureCodeBox?logo=GitHub"/></a>
+  <a href="https://twitter.com/securecodebox"><img alt="Twitter Follower" src="https://img.shields.io/twitter/follow/securecodebox?style=flat&color=blue&logo=twitter"/></a>
+</p>
+
+## What is OWASP secureCodeBox?
+
+<p align="center">
+  <img alt="secureCodeBox Logo" src="https://www.securecodebox.io/img/Logo_Color.svg" width="250px"/>
+</p>
+
+_[OWASP secureCodeBox][scb-github]_ is an automated and scalable open source solution that can be used to integrate various *security vulnerability scanners* with a simple and lightweight interface. The _secureCodeBox_ mission is to support *DevSecOps* Teams to make it easy to automate security vulnerability testing in different scenarios.
+
+With the _secureCodeBox_ we provide a toolchain for continuous scanning of applications to find the low-hanging fruit issues early in the development process and free the resources of the penetration tester to concentrate on the major security issues.
+
+The secureCodeBox project is running on [Kubernetes](https://kubernetes.io/). To install it you need [Helm](https://helm.sh), a package manager for Kubernetes. It is also possible to start the different integrated security vulnerability scanners based on a docker infrastructure.
+
+### Quickstart with secureCodeBox on kubernetes
+
+You can find resources to help you get started on our [documentation website](https://www.securecodebox.io) including instruction on how to [install the secureCodeBox project](https://www.securecodebox.io/docs/getting-started/installation) and guides to help you [run your first scans](https://www.securecodebox.io/docs/getting-started/first-scans) with it.
+
+## Supported Tags
+- `latest`  (represents the latest stable release build)
+- tagged releases, e.g. `3.0.0`, `2.9.0`, `2.8.0`, `2.7.0`
+
+## How to use this image
+This `scanner` image is intended to work in combination with the corresponding `parser` image to parse the scanner `findings` to generic secureCodeBox results. For more information details please take a look at the [project page][scb-docs] or [documentation page][https://www.securecodebox.io/docs/scanners/WPScan].
+
+```bash
+docker pull securecodebox/scanner-wpscan
+```
+
+## What is WPScan?
+
+WPScan is a free, for non-commercial use, black box WordPress vulnerability scanner written for security professionals and blog maintainers to test the security of their sites.
+
+> NOTE: You need to provide WPSan with an API Token so that it can look up vulnerabilities infos with [https://wpvulndb.com](https://wpvulndb.com). Without the token WPScan will only identify WordPress Core / Plugin / Theme versions but not if they are actually vulnerable. You can get a free API Token at by registering for an account at [https://wpvulndb.com](https://wpvulndb.com). Using the secureCodeBox WPScans you can specify the token via the `WPVULNDB_API_TOKEN` target attribute, see the example below.
+
+To learn more about the WPScan scanner itself visit [wpscan.org] or [wpscan.io].
+
+## Scanner Configuration
+
+The following security scan configuration example are based on the [WPScan Documentation], please take a look at the original documentation for more configuration examples.
+
+* Scan all plugins with known vulnerabilities: `wpscan --url example.com -e vp --plugins-detection mixed --api-token WPVULNDB_API_TOKEN`
+* Scan all plugins in our database (could take a very long time): `wpscan --url example.com -e ap --plugins-detection mixed --api-token WPVULNDB_API_TOKEN`
+* Password brute force attack: `wpscan --url example.com -e u --passwords /path/to/password_file.txt`
+* WPScan keeps a local database of metadata that is used to output useful information, such as the latest version of a plugin. The local database can be updated with the following command: `wpscan --update`
+* When enumerating the WordPress version, installed plugins or installed themes, you can use three different "modes", which are:
+  * passive
+  * aggressive
+  * mixed
+  If you want the most results use the "mixed" mode. However, if you are worried that the server may not be able to handle many requests, use the "passive" mode. The default mode is "mixed", except plugin enumeration, which is "passive". You will need to manually override the plugin detection mode, if you want to use anything other than the default, with the `--plugins-detection` option.
+* WPScan can enumerate various things from a remote WordPress application, such as plugins, themes, usernames, backed up files wp-config.php files, Timthumb files, database exports and more. To use WPScan's enumeration capabilities supply the `-e `option.
+
+```bash
+Available Choices:
+  vp  |  Vulnerable plugins
+  ap  |  All plugins
+  p   |  Plugins
+  vt  |  Vulnerable themes
+  at  |  All themes
+  t   |  Themes
+  tt  |  Timthumbs
+  cb  |  Config backups
+  dbe |  Db exports
+  u   |  User IDs range. e.g: u1-5
+         Range separator to use: '-'
+         Value if no argument supplied: 1-10
+  m   |  Media IDs range. e.g m1-15
+         Note: Permalink setting must be set to "Plain" for those to be detected
+         Range separator to use: '-'
+         Value if no argument supplied: 1-100
+
+Separator to use between the values: ','
+Default: All Plugins, Config Backups
+Value if no argument supplied: vp,vt,tt,cb,dbe,u,m
+Incompatible choices (only one of each group/s can be used):
+  - vp, ap, p
+  - vt, at, t
+```
+
+## Community
+
+You are welcome, please join us on... 👋
+
+- [GitHub][scb-github]
+- [Slack][scb-slack]
+- [Twitter][scb-twitter]
+
+secureCodeBox is an official [OWASP][scb-owasp] project.
+
+## License
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+
+As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).
+
+As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.
+
+[scb-owasp]: https://www.owasp.org/index.php/OWASP_secureCodeBox
+[scb-docs]: https://www.securecodebox.io/
+[scb-site]: https://www.securecodebox.io/
+[scb-github]: https://github.com/secureCodeBox/
+[scb-twitter]: https://twitter.com/secureCodeBox
+[scb-slack]: https://join.slack.com/t/securecodebox/shared_invite/enQtNDU3MTUyOTM0NTMwLTBjOWRjNjVkNGEyMjQ0ZGMyNDdlYTQxYWQ4MzNiNGY3MDMxNThkZjJmMzY2NDRhMTk3ZWM3OWFkYmY1YzUxNTU
+[scb-license]: https://github.com/secureCodeBox/secureCodeBox/blob/master/LICENSE
+[wpscan.io]: https://wpscan.io/
+[wpscan.org]: https://wpscan.org/
+[WPScan Documentation]: https://github.com/wpscanteam/wpscan/wiki/WPScan-User-Documentation
diff --git a/scanners/wpscan/scanner/Dockerfile b/scanners/wpscan/scanner/Dockerfile
@@ -0,0 +1,18 @@
+
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+ARG scannerVersion
+
+FROM wpscanteam/wpscan:$scannerVersion
+
+COPY wrapper.sh /wrapper.sh
+
+USER root
+
+RUN mkdir /home/securecodebox/
+
+USER wpscan
+
+ENTRYPOINT [ "sh", "/wrapper.sh" ]
diff --git a/scanners/wpscan/scanner/wrapper.sh b/scanners/wpscan/scanner/wrapper.sh
@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2021 iteratec GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+wpscan $@
+wpscan_exit=$?
+echo "wpscan exited with $wpscan_exit"
+
+# wpscan returns a non zero exit code when it finds vulnerabilitys
+# exit codes 1, 2 ,3 and 4 are errors, 5 means vulnerabilitys were found
+# see https://github.com/wpscanteam/CMSScanner/blob/master/lib/cms_scanner/exit_code.rb
+if [[ $wpscan_exit -eq 1 ]] || [[ $wpscan_exit -eq 2 ]] || [[ $wpscan_exit -eq 3 ]] || [[ $wpscan_exit -eq 4 ]]
+then
+    fake_exit_code=$wpscan_exit
+else
+    fake_exit_code=0
+fi
+
+exit $fake_exit_code
diff --git a/scanners/wpscan/templates/wpscan-scan-type.yaml b/scanners/wpscan/templates/wpscan-scan-type.yaml
@@ -35,7 +35,8 @@ spec:
               image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"
               imagePullPolicy: {{ .Values.scanner.image.pullPolicy }}
               command:
-                - "wpscan"
+                - "sh"
+                - "/wrapper.sh"
                 - "-o"
                 - "/home/securecodebox/wpscan-results.json"
                 - "-f"

diff --git a/scanners/wpscan/values.yaml b/scanners/wpscan/values.yaml
@@ -31,7 +31,7 @@ parser:
 scanner:
   image:
     # scanner.image.repository -- Container Image to run the scan
-    repository: wpscanteam/wpscan
+    repository: docker.io/securecodebox/scanner-wpscan
     # scanner.image.tag -- defaults to the charts appVersion
     tag: null
     # -- Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
-Original file line number
+Diff line change
@@ Expand Up / @@ -370,6 +370,7 @@ jobs: @@
               - sslyze
               - typo3scan
               - whatweb
+              - wpscan
         steps:
           - name: Checkout
@@ Expand Down @@