FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Updated uage examples for new cli · secureCodeBox/secureCodeBox-v2@0bb6104 · GitHub

This repository was archived by the owner on Oct 14, 2020. It is now read-only.
/ secureCodeBox-v2 Public archive

Commit 0bb6104

Browse files
J12934
committed
Updated uage examples for new cli
1 parent e4dbd89 commit 0bb6104

3 files changed

Lines changed: 125 additions & 97 deletions

File tree

‎docs/user-guide/usage-examples/arachni-bodgeit-example.md‎

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -16,31 +16,35 @@ This configuration could be improved by configuring a login method for the scann
1616

1717
### Start the scan via HTTP API
1818

19-
`PUT http://localhost:8080/box/processes/arachni_webapplicationscan`
19+
`PUT http://localhost:8080/box/securityTests`
2020

2121
### Start the scan via CLI
2222

23-
`run_scanner.sh --payload payloadFile.json arachni`
23+
`run_scanner.sh --payload payloadFile.json`
2424

2525
### Payload
2626

2727
```json
2828
[
29-
{
30-
"name": "Arachni BodgeIt Scan",
31-
"location": "http://bodgeit:8080/bodgeit/",
32-
"attributes": {
33-
"ARACHNI_DOM_DEPTH_LIMIT": 15,
34-
"ARACHNI_DIR_DEPTH_LIMIT": 5,
35-
"ARACHNI_PAGE_LIMIT": 50,
36-
"ARACHNI_EXCLUDE_PATTERNS": [
37-
".*\\.png",
38-
".*util\\.js",
39-
".*style\\.css"
40-
],
41-
"ARACHNI_SCAN_METHODS": "*"
42-
}
29+
{
30+
"context": "BodgeIt",
31+
"name": "arachni",
32+
"target": {
33+
"name": "BodgeIt-local",
34+
"location": "http://bodgeit:8080/bodgeit/",
35+
"attributes": {
36+
"ARACHNI_DOM_DEPTH_LIMIT": 15,
37+
"ARACHNI_DIR_DEPTH_LIMIT": 5,
38+
"ARACHNI_PAGE_LIMIT": 50,
39+
"ARACHNI_EXCLUDE_PATTERNS": [
40+
".*\\.png",
41+
".*util\\.js",
42+
".*style\\.css"
43+
],
44+
"ARACHNI_SCAN_METHODS": "*"
45+
}
4346
}
47+
}
4448
]
4549
```
4650

‎docs/user-guide/usage-examples/arachni-juice-shop-example.md‎

Lines changed: 39 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -14,27 +14,31 @@ To start of we should test weather the secureCodeBox and Juice Shop is properly
1414

1515
### Start the test scan via HTTP API
1616

17-
`PUT http://localhost:8080/box/processes/arachni_webapplicationscan`
17+
`PUT http://localhost:8080/box/securityTests`
1818

1919
### Start the test scan via CLI
2020

21-
`run_scanner.sh --payload payloadFile.json arachni`
21+
`run_scanner.sh --payload payloadFile.json`
2222

2323
### Test payload
2424

2525
```json
2626
[
27-
{
28-
"name": "Arachni Quick Test Scan",
29-
"location": "http://juice-shop:3000/",
30-
"attributes": {
31-
"ARACHNI_DOM_DEPTH_LIMIT": 5,
32-
"ARACHNI_DIR_DEPTH_LIMIT": 5,
33-
"ARACHNI_PAGE_LIMIT": 1,
34-
"ARACHNI_EXCLUDE_PATTERNS": [],
35-
"ARACHNI_SCAN_METHODS": "*"
36-
}
27+
{
28+
"name": "arachni",
29+
"context": "Arachni Quick JuiceShop Scan",
30+
"target": {
31+
"name": "JuiceShop-local",
32+
"location": "http://juice-shop:3000/",
33+
"attributes": {
34+
"ARACHNI_DOM_DEPTH_LIMIT": 5,
35+
"ARACHNI_DIR_DEPTH_LIMIT": 5,
36+
"ARACHNI_PAGE_LIMIT": 1,
37+
"ARACHNI_EXCLUDE_PATTERNS": [],
38+
"ARACHNI_SCAN_METHODS": "*"
39+
}
3740
}
41+
}
3842
]
3943
```
4044

@@ -53,33 +57,37 @@ This is done by configuring the following parameters:
5357

5458
### Start the full scan via HTTP API
5559

56-
`PUT http://localhost:8080/box/processes/arachni_webapplicationscan`
60+
`PUT http://localhost:8080/box/securityTests`
5761

5862
### Start the full scan via CLI
5963

60-
`run_scanner.sh --payload payloadFile.json arachni`
64+
`run_scanner.sh --payload payloadFile.json`
6165

6266
### Full payload
6367

6468
```json
6569
[
66-
{
67-
"name": "In Depth Arachni Scan",
68-
"location": "http://juice-shop:3000/",
69-
"attributes": {
70-
"ARACHNI_DOM_DEPTH_LIMIT": 50,
71-
"ARACHNI_DIR_DEPTH_LIMIT": 10,
72-
"ARACHNI_PAGE_LIMIT": 100,
73-
"ARACHNI_EXCLUDE_PATTERNS": [
74-
".*socket\\.io.*",
75-
".*node_modules.*",
76-
".*public/images.*",
77-
".*/css.*"
78-
],
79-
"ARACHNI_SCAN_METHODS": "*",
80-
"ARACHNI_EXTEND_PATH": ["/#/administration"],
81-
"ARACHNI_LOGIN_SCRIPT_FILENAME": "login_juice_shop.rb"
82-
}
70+
{
71+
"name": "arachni",
72+
"context": "In Depth Arachni JuiceShop Scan",
73+
"target": {
74+
"name": "JuiceShop-local",
75+
"location": "http://juice-shop:3000/",
76+
"attributes": {
77+
"ARACHNI_DOM_DEPTH_LIMIT": 50,
78+
"ARACHNI_DIR_DEPTH_LIMIT": 10,
79+
"ARACHNI_PAGE_LIMIT": 100,
80+
"ARACHNI_EXCLUDE_PATTERNS": [
81+
".*socket\\.io.*",
82+
".*node_modules.*",
83+
".*public/images.*",
84+
".*/css.*"
85+
],
86+
"ARACHNI_SCAN_METHODS": "*",
87+
"ARACHNI_EXTEND_PATH": ["/#/administration"],
88+
"ARACHNI_LOGIN_SCRIPT_FILENAME": "login_juice_shop.rb"
89+
}
8390
}
91+
}
8492
]
8593
```

‎docs/user-guide/usage-examples/zap-bodgeit-example.md‎

Lines changed: 66 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -15,24 +15,28 @@ This is a straight forward configuration. Which should finish relativly quickly
1515

1616
### Start the scan via HTTP API
1717

18-
`PUT http://localhost:8080/box/processes/zap-process`
18+
`PUT http://localhost:8080/box/securityTests`
1919

2020
### Start the scan via CLI
2121

22-
`run_scanner.sh --payload payloadFile.json zap`
22+
`run_scanner.sh --payload payloadFile.json`
2323

2424
### Test Payload
2525

2626
```json
2727
[
28-
{
29-
"name": "ZAP BodgeIt Scan",
30-
"location": "http://bodgeit:8080/bodgeit/",
31-
"attributes": {
32-
"ZAP_BASE_URL": "http://bodgeit:8080/bodgeit/",
33-
"ZAP_SPIDER_MAX_DEPTH": 1
34-
}
28+
{
29+
"name": "zap",
30+
"context": "ZAP BodgeIt Scan",
31+
"target": {
32+
"name": "BodgeIt-local",
33+
"location": "http://bodgeit:8080/bodgeit/",
34+
"attributes": {
35+
"ZAP_BASE_URL": "http://bodgeit:8080/bodgeit/",
36+
"ZAP_SPIDER_MAX_DEPTH": 1
37+
}
3538
}
39+
}
3640
]
3741
```
3842

@@ -44,7 +48,7 @@ The following example contains a fully configured ZAP Scan for the BodgeIt Store
4448

4549
### Start the full scan via HTTP API
4650

47-
`PUT http://localhost:8080/box/processes/zap-process`
51+
`PUT http://localhost:8080/box/securityTests`
4852

4953
### Start the full scan via CLI
5054

@@ -54,23 +58,27 @@ The following example contains a fully configured ZAP Scan for the BodgeIt Store
5458

5559
```json
5660
[
57-
{
58-
"name": "ZAP BodgeIt Scan",
59-
"location": "http://bodgeit:8080/bodgeit/",
60-
"attributes": {
61-
"ZAP_BASE_URL": "http://bodgeit:8080/bodgeit/",
62-
"ZAP_AUTHENTICATION": true,
63-
"ZAP_LOGIN_SITE": "http://bodgeit:8080/bodgeit/login.jsp",
64-
"ZAP_LOGIN_USER": "test@thebodgeitstore.com",
65-
"ZAP_LOGIN_PW": "password",
66-
"ZAP_PW_FIELD_ID": "password",
67-
"ZAP_USERNAME_FIELD_ID": "username",
68-
"ZAP_LOGGED_IN_INDICATOR": "You have logged in successfully",
69-
"ZAP_SPIDER_MAX_DEPTH": 5,
70-
"ZAP_SCANNER_DELAY_IN_MS": 10,
71-
"ZAP_THREADS_PER_HOST": 2
72-
}
61+
{
62+
"name": "zap",
63+
"context": "ZAP BodgeIt Scan",
64+
"target": {
65+
"name": "BodgeIt-local",
66+
"location": "http://bodgeit:8080/bodgeit/",
67+
"attributes": {
68+
"ZAP_BASE_URL": "http://bodgeit:8080/bodgeit/",
69+
"ZAP_AUTHENTICATION": true,
70+
"ZAP_LOGIN_SITE": "http://bodgeit:8080/bodgeit/login.jsp",
71+
"ZAP_LOGIN_USER": "test@thebodgeitstore.com",
72+
"ZAP_LOGIN_PW": "password",
73+
"ZAP_PW_FIELD_ID": "password",
74+
"ZAP_USERNAME_FIELD_ID": "username",
75+
"ZAP_LOGGED_IN_INDICATOR": "You have logged in successfully",
76+
"ZAP_SPIDER_MAX_DEPTH": 5,
77+
"ZAP_SCANNER_DELAY_IN_MS": 10,
78+
"ZAP_THREADS_PER_HOST": 2
79+
}
7380
}
81+
}
7482
]
7583
```
7684

@@ -82,7 +90,7 @@ It is also possible to run the zap scan process with a predefined sitemap. In th
8290

8391
### Start the scan via HTTP API
8492

85-
`PUT http://localhost:8080/box/processes/zap-process`
93+
`PUT http://localhost:8080/box/securityTests`
8694

8795
### Start the full scan via CLI
8896

@@ -91,34 +99,42 @@ It is also possible to run the zap scan process with a predefined sitemap. In th
9199
### Payload to start scan (without spider)
92100

93101
```json
94-
[{
102+
[
103+
{
95104
"name": "ZAP BodgeIt Scan with given sitemap ",
96105
"location": "http://bodgeit:8080/bodgeit",
97106
"attributes": {
98-
"ZAP_BASE_URL": "http://bodgeit:8080/bodgeit",
99-
"ZAP_SITEMAP": [{
100-
"request": {
101-
"method": "GET",
102-
"url": "http://bodgeit:8080/bodgeit/search.jsp?q=ZAP",
103-
"httpVersion": "HTTP/1.1",
104-
"headers": [],
105-
"queryString": [{
106-
"name": "q",
107-
"value": "ZAP"
108-
}],
109-
"postData": {
110-
"mimeType": "",
111-
"params": [],
112-
"text": ""
113-
}
114-
},
115-
"ZAP_BASE_URL": "http://bodgeit:8080/bodgeit"
116-
}]
107+
"ZAP_BASE_URL": "http://bodgeit:8080/bodgeit",
108+
"ZAP_SITEMAP": [
109+
{
110+
"request": {
111+
"method": "GET",
112+
"url": "http://bodgeit:8080/bodgeit/search.jsp?q=ZAP",
113+
"httpVersion": "HTTP/1.1",
114+
"headers": [],
115+
"queryString": [
116+
{
117+
"name": "q",
118+
"value": "ZAP"
119+
}
120+
],
121+
"postData": {
122+
"mimeType": "",
123+
"params": [],
124+
"text": ""
125+
}
126+
},
127+
"ZAP_BASE_URL": "http://bodgeit:8080/bodgeit"
128+
}
129+
]
117130
}
118-
}]
131+
}
132+
]
119133
```
120134

121135
### The Sitemap Parameter
136+
122137
The sitemap contains request objects in a HAR format. To generate the requests for your sitemap, you can:
123-
* take the result of previous microservice zap spider tasks via camunda ui OR
124-
* use a local running ZAP application as a proxy, browse manully through your target and import the recorded requests via "http://[your-local-zap]:[your-zap-port]/UI/core/other/messagesHar/"
138+
139+
- take the result of previous microservice zap spider tasks via camunda ui OR
140+
- use a local running ZAP application as a proxy, browse manully through your target and import the recorded requests via "http://[your-local-zap]:[your-zap-port]/UI/core/other/messagesHar/"

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL