Skip to content

Latest commit

 

History

History
316 lines (207 loc) · 8.69 KB

README.md

File metadata and controls

316 lines (207 loc) · 8.69 KB
Raw

Contributor's Guide

Quick Reference

--------------------WIP-------------------

command description

Table of Contents

Setup

Make Changes

Submit

Setup

Prerequisites

Prerequisite Version
Ruby ~
Rails ~
Postgres ~
Python ~

Updating to the latest releases is recommended.

If Ruby, Pythond, Rails or Postgres are already installed on your machine, run the following commands to validate the versions:

python --version
postgres -v
ruby -v
rails -v

Forking the Project

Setting Up Your System

  1. Install Git or your favorite Git client.

Forking

  1. Go to the top level SecurityAnalizer repository: https://github.com/gmotzespina/SecurityAnalizer
  2. Click the "Fork" Button in the upper right hand corner of the interface (More Details Here)
  3. After the repository (repo) has been forked, you will be taken to your copy of the SecurityAnalizer repo at https://github.com/yourUsername/SecurityAnalizer

Cloning Your Fork

  1. Open a Terminal / Command Line / Bash Shell in your projects directory (i.e.: /yourprojectdirectory/)
  2. Clone your fork of SecurityAnalizer
$ git clone https://github.com/yourUsername/SecurityAnalizer.git

(make sure to replace yourUsername with your GitHub username)

This will download the entire repo to your projects directory.

Setup Your Upstream

  1. Change directory to the new SecurityAnalizer directory (cd SecurityAnalizer)
  2. Add a remote to the official SecurityAnalizer repo:
$ git remote add upstream https://github.com/gmotzespina/SecurityAnalizer

Congratulations, you now have a local copy of the SecurityAnalizer repo!

Maintaining Your Fork

Now that you have a copy of your fork, there is work you will need to do to keep it current.

Rebasing from Upstream

Do this prior to every time you create a branch for a PR:

  1. Make sure you are on the master branch
$ git status
On branch master
Your branch is up-to-date with 'origin/master'.

If your aren't on master, resolve outstanding files / commits and checkout the master branch

$ git checkout master
  1. Do a pull with rebase against upstream
$ git pull --rebase upstream master

This will pull down all of the changes to the master branch, without making an additional commit in your local repo.

  1. (Optional) Force push your updated master branch to your GitHub fork
$ git push origin master --force

This will overwrite the master branch of your fork.

Create a Branch

Before you start working, you will need to create a separate branch specific to the issue / feature you're working on. You will push your work to this branch.

Naming Your Branch

Name the branch something like fix/xxx or feature/xxx where xxx is a short description of the changes or feature you are attempting to add. For example fix/email-login would be a branch where you fix something specific to email login.

Adding Your Branch

To create a branch on your local machine (and switch to this branch):

$ git checkout -b [name_of_your_new_branch]

and to push to GitHub:

$ git push origin [name_of_your_new_branch]

If you need more help with branching, take a look at this.

Set Up Postgres

--------------------WIP-------------------

Set Up SecurityAnalizer

--------------------WIP------------------- Once you have SecurityAnalizer cloned, before you start the application, you first need to install all of the dependencies:

# Install Bundle dependencies
bundle install

--------------------WIP-------------------



Now navigate to your browser and open http://localhost:3000. If the app loads, congratulations – you're all set.


Set up Docker


How to run this project


    

  • 

    Install docker and docker-compose
    

    • 

  • 

    to run the project do:
    

    • 



$ docker-compose build web


$ docker-compose run --rm web rails db:create db:migrate


$ docker-compose up web


Make Changes


This bit is up to you!


Run The Test Suite


--------------------WIP-------------------
When you're ready to share your code, run the test suite:


$  test


and ensure all tests pass.


Creating a Pull Request


Important: ALWAYS EDIT ON A BRANCH


Methods


Next Steps


If your PR is accepted


Once your PR is accepted, you may delete the branch you created to submit it.
This keeps your working fork clean.


You can do this with a press of a button on the GitHub PR interface. You can
delete the local copy of the branch with: git branch -D branch/to-delete-name


If your PR is rejected


If you have a local copy of the repo, you can make the requested changes and
amend your commit with: git commit --amend This will update your existing
commit. When you push it to your fork you will need to do a force push to
overwrite your old commit: git push --force


Be sure to post in the PR conversation that you have made the requested changes.


TL;DR: Steps to make a change




Web Vulnerabilities REST API Scanner


Web Vulnerabilities REST API Scanner is a Python REST API to find the most common web vulnerabilities in your Website
using the Black-Box Method. This REST API have a conecction with a Ruby on Rails Web App to send requests and responses
to have a control of your scanners. This is based on a Open Source Project called
WAScann, some Classes, Libraries and Data were taken from it.


screen


Features


REST API


    

  • Send resquests and responses in JSON Format
    • 

  • Resquest status
    • 

  • Communication with Ruby on Rails Web App
    • 

  • Exceptions handler
    • 

  • Threading Jobs
    • 



Attacks


    

  • Blind SQL Injection
    • 

  • SQL Injection in Headers
    • 

  • XSS in Headers
    • 

  • HTML Injection
    • 

  • LDAP Injection
    • 

  • Local File Inclusion
    • 

  • OS Commanding
    • 

  • PHP Code Injection
    • 

  • SQL Injection
    • 

  • Server Side Injection
    • 

  • XPath Injection
    • 

  • Cross Site Scripting
    • 

  • XML External Entity
    • 



Installation


$ git clone https://github.com/AndresSan6/VulnerabilityScannerPython.git
$ cd Vulnerability Scanner Python 
$ pip install -r requirements.txt
$ python main.py



Usage


You need Postman to test the REST API and start the server


JSON REQUEST FORMAT:


    {
	"url": "http://example.com",
	"idScann": 1,
	"Authentication_Token": 
		"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzYWx1ZG9zIGFjYWRlbXkgMjAxOGIiLCJuYW1lIj
		oiY29tZSBmcnV0YXMgeSB2ZXJkdXJhcyIsImlhdCI6MTUxNjIzOTAyMn0.BPtUskACc5sxOFMB38iFx4tmzrNZ9l
		uwa6c	KHL-etDQ",
	"vulnerabilities": ["blindsqli","xss"]
	
    }
        



1.- Set Content-Type with value "application/json" on Headers


screen_2


2.- Write the JSON Request


screen_3


3.- Send your request


screen_3


4.- Ready !