turbot/steampipe-plugin-crtsh

Use SQL to instantly query crt.sh for certificates, log entries and more. Open source CLI. No DB required.

crt.sh Plugin for Steampipe

Use SQL to query certificates, log entries and more from the crt.sh certificate transparency database.

• Get started →
• Documentation: Table definitions & examples
• Community: Join #steampipe on Slack →
• Get involved: Issues

Quick start

Install the plugin with Steampipe:

steampipe plugin install crtsh

Configure the server address in ~/.steampipe/config/crtsh.spc:

connection "crtsh" {
  plugin = "crtsh"
}

Run steampipe:

steampipe query

Query certificates:

select
  dns_names,
  not_after
from
  crtsh_certificate
where
  query = 'steampipe.io';

+------------------------+---------------------------+
| dns_names              | not_after                 |
+------------------------+---------------------------+
| ["steampipe.io"]       | 2022-10-24T08:48:52-04:00 |
| ["cloud.steampipe.io"] | 2022-10-20T22:56:08-04:00 |
+------------------------+---------------------------+

Enumerate and discover subdomains for a given domain:

with raw_domains as (
  -- Search for any certificates matching steampipe.io
  select distinct
    jsonb_array_elements_text(dns_names) as domain
  from
    crtsh_certificate
  where
    query = 'steampipe.io'
)
select
  *
from
  raw_domains
where
  -- filter out mixed domains (e.g. from shared status page services)
  domain like '%steampipe.io'
order by
  domain;

+--------------------+
| domain             |
+--------------------+
| cloud.steampipe.io |
| hub.steampipe.io   |
| steampipe.io       |
| www.steampipe.io   |
+--------------------+

Engines

This plugin is available for the following engines:

Engine	Description
Steampipe	The Steampipe CLI exposes APIs and services as a high-performance relational database, giving you the ability to write SQL-based queries to explore dynamic data. Mods extend Steampipe's capabilities with dashboards, reports, and controls built with simple HCL. The Steampipe CLI is a turnkey solution that includes its own Postgres database, plugin management, and mod support.
Postgres FDW	Steampipe Postgres FDWs are native Postgres Foreign Data Wrappers that translate APIs to foreign tables. Unlike Steampipe CLI, which ships with its own Postgres server instance, the Steampipe Postgres FDWs can be installed in any supported Postgres database version.
SQLite Extension	Steampipe SQLite Extensions provide SQLite virtual tables that translate your queries into API calls, transparently fetching information from your API or service as you request it.
Export	Steampipe Plugin Exporters provide a flexible mechanism for exporting information from cloud services and APIs. Each exporter is a stand-alone binary that allows you to extract data using Steampipe plugins without a database.
Turbot Pipes	Turbot Pipes is the only intelligence, automation & security platform built specifically for DevOps. Pipes provide hosted Steampipe database instances, shared dashboards, snapshots, and more.

Developing

Prerequisites:

• Steampipe
• Golang

Clone:

git clone https://github.com/turbot/steampipe-plugin-crtsh.git
cd steampipe-plugin-crtsh

Build, which automatically installs the new version to your ~/.steampipe/plugins directory:

make

Configure the plugin:

cp config/* ~/.steampipe/config
vi ~/.steampipe/config/crtsh.spc

Try it!

steampipe query
> .inspect crtsh

Further reading:

• Writing plugins
• Writing your first table

Open Source & Contributing

This repository is published under the Apache 2.0 (source code) and CC BY-NC-ND (docs) licenses. Please see our code of conduct. We look forward to collaborating with you!

Steampipe is a product produced from this open source software, exclusively by Turbot HQ, Inc. It is distributed under our commercial terms. Others are allowed to make their own distribution of the software, but cannot use any of the Turbot trademarks, cloud services, etc. You can learn more in our Open Source FAQ.

Get Involved

Join #steampipe on Slack →

Want to help but don't know where to start? Pick up one of the help wanted issues:

• Steampipe
• crt.sh Plugin

steampipe-plugin-crtsh's Issues

Plugin is broken in Pipes Cloud

Describe the bug
Plugin is broken; queries (including datatank harvesting) error with

Error: rpc error: code = Internal desc = crtsh: rpc error: code = Internal desc = hydrate function listCertificate failed with panic setting PGSYSCONFDIR not supported (SQLSTATE HV000)

Steampipe version (steampipe -v)
Steampipe v0.22.0 locally, but this occurs in Pipes as well.

Plugin version (steampipe plugin list)
Unclear, this is running in Pipes

To reproduce
Query one of the tables provided by the plugin. For example:

select dns_names, not_after, not_before  from crtsh_certificate where query = 'turbot.com' AND not_after > now()

Expected behavior
The query returns results :)

Additional context
Add any other context about the problem here.