Use Scumblr if you are looking for intelligent automation framework

Scumblr is a web application that allows performing periodic syncs of data sources (such as Github repositories and URLs) and performing analysis (such as static analysis, dynamic checks, and metadata collection) on the identified results. Scumblr searches using plugins called Tasks. Each Task knows how to perform a search or sync via a certain site or API (Github, Route53, Google, Pastebin, Twitter, etc.). Tasks can be configured from within Scumblr based on the options available by the Task.

Key Features :

Scumblr ships with a number of tasks to help you streamline security automation including:

Sync Tasks

• Github – Sync results from github Repositories
• Route53 DNS – Sync FQDNs from Route53 DNS
• Manual Result Upload – Specify a new line delimited list of results you’d like to sync into Scumblr

Security Tasks

• Github Search – Search Github for secrets, anti-patterns, and vulnerabilities in your repositories
• Curl – Execute curl commands to identify vulnerabilities or issues against Scumblr results
• Bandit – Perform static code analysis against Python projects
• Brakeman – Perform static code analysis against Ruby on Rails projects.

Search Tasks (legacy)

• Google
• Facebook
• Twitter
• iTunes Store
• Certificate Transparency
• Ebay
• Google Play
• Reddit
• RSS Feeds (useful for full disclosure searches)
• YouTube

Scumblr also provides a number of other features that streamline security automation including:

• Tracking, ticketing, regression monitoring, and auto-remediation of security vulnerabilities
• Metadata storage in results to allow for advanced result filtering
• Customizable views and sorting of results and tasks to get you to the important details faster
• Saveable result filters that can be shared with collegues
• Event model for auditing changes to results so you can keep an eye on what is happening
• Email subscriptions for specific results or tasks you care about (such as monitoring when a security task finds a new vulnerablity)
• Advanced asynchronous task scheduling to allow for task chaining and task batching

Use Cases:

Following are just sample of what you might want to look for or analyze

• Your organization’s public or private github repositories
• When new FQDNS are created in your organization’s DNS
• Detection of anti-patterns in source code
• Dynamic checks against running web servers for security issues
• Static code analysis across a large number of repositories using Brakeman or Bandit
• Get an alert on full disclosure security reports on vulnerabilities in your team’s version of Apache

Take a look at the wiki for detailed instructions on setup, configuration, and use!

Also checkout Getting Started guide for some basic use cases of Scumblr.

Like this post? Don’t forget to share it!