Argo CD weak credential tester

[JamesFoxxx]

according to this setup: https://github.com/google/security-testbeds/pull/60/files

[leonardo-doyensec]

Hi @JamesFoxxx, thank you for your contribution. I'm noticing that the plugin is not working on my side, can you please check it? Feels like the fingerprint phase never ran.

[JamesFoxxx]

@leonardo-doyensec hii
you are right, I'm using tsunami v0.0.24 with the --http-client-trust-all-certificates(google/tsunami-security-scanner#118) switch, and with a few changes it is working now.

Also according to the last commit, it seems that tsunami doesn't redirect by default for the 307 redirect status code and It's weird because the http redirect is true by default.

[JamesFoxxx]

@leonardo-doyensec we should compile two separate gradle projects, one for weak credentials and one for the web fingerprint, and use both plugins when running the Tsunami scanner.

[leonardo-doyensec]

Hello @JamesFoxxx, thank you for your changes.
I confirm that the plugin is working correctly. You can find some issues to address down below.

[leonardo-doyensec]

LGTM - Approved
@maoning we can merge this and google/security-testbeds#60

Reviewer: Leonardo, Doyensec
Plugin: Argo CD Weak Credentials Tester