ArrafiNurHafiz/scanner-vulnerability

                                    _   _       _ _   _           _   _

  ___  _ __   ___ _   _ _ __  __ _| | | |_   _| | | | |__  _   _| |_| |__

 / _ \| '_ \ / _ \ | | | '_ \/ _` | | | \ \ / / | | | '_ \| | | | __| '_ \

| (_) | |_) |  __/ |_| | | | | (_| | | | |\ V /| | | | | | | |_| | |_| | | |

 \___/| .__/ \___|\__,_|_| |_|\__,_|_| |_| \_/ |_|_| |_| |_|\__,_|\__|_| |_|

      |_|



  自主漏洞扫描器


  CLI 优先。并行。模块化。开源。





  

  

  

  






## ✦ 功能

- **并行 4 个扫描器** — 供应链、SAST、secrets、容器
- **基于 trait 的架构** — 无需修改核心即可接入新扫描器
- **多报告输出** — JSON 机器输出 + 深色 HTML 仪表盘
- **零依赖** 工具编排 — 原生工具直接管道传输，从不重复造轮子
- **彩色终端** — 一目了然的严重性分级输出

## ✦ 快速开始


```
# 初始化项目工作区

openvulnhub init



# 全量扫描当前目录

openvulnhub scan --all



# Container image 扫描

openvulnhub scan --container --image alpine:latest



# 从最新扫描生成 HTML 报告

openvulnhub report --format html
```


## ✦ 扫描器矩阵


```
┌────────────────┬──────────────────┬──────────────────────────────────┐

│    Scanner     │      Tool        │          Detects                 │

├────────────────┼──────────────────┼──────────────────────────────────┤

│  Supply Chain  │  Syft + Grype    │  npm, pip, gem, cargo vulns      │

│  SAST          │  Semgrep         │  Code quality, injection, XSS    │

│  Secrets       │  TruffleHog /    │  API keys, tokens, credentials   │

│                │  Gitleaks        │                                  │

│  Container     │  Trivy           │  OS package CVEs, misconfigs     │

└────────────────┴──────────────────┴──────────────────────────────────┘
```


## ✦ 架构


```
src/

├── main.rs           Entry point + scan orchestrator

├── cli.rs            Clap CLI definitions

├── report.rs         JSON + HTML report generator

└── scanner/

    ├── mod.rs        Scanner trait, Finding, ScanReport

    ├── supply_chain.rs

    ├── sast.rs

    ├── secrets.rs

    ├── container.rs
```


每个扫描器都实现了 `Scanner` trait：


```
#[async_trait]

pub trait Scanner: Send + Sync {

    fn name(&self) -> &'static str;

    fn is_installed(&self) -> bool;

    async fn run(&self, target: &ScanTarget) -> Result>;

}
```


## ✦ 安装依赖


```
# Supply chain

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin



# SAST

pip install semgrep



# Secrets（两者皆可）

curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

brew install gitleaks            # macOS



# Container

curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
```


## ✦ 路线图


```
P1 ── DAST (Nuclei) ─ IaC (Checkov) ─ Config file ─ Multiple formats

P2 ── AI swarm agents ─ P2P mesh ─ Real-time collaboration

P3 ── Predictive engine ─ Blockchain SBOM ─ DFIR
```


## ✦ 许可证

MIT