feat(engine_dast): new dast scanning engine. #140

russbelln · 2024-05-07T23:01:06Z

Description

Add new dast scanning engine
Add the Nuclei tool as driven adapter of the new engine

Checklist:

The pull request is complete according to the guide of contributing of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have added tests that prove my feature, policy, or fix is effective and works
New and existing tests pass locally with my changes

…ne-tools into feature/engine_dast_nu

github-advanced-security · 2024-05-17T16:29:51Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

tools/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py

sonarcloud · 2024-05-30T20:28:22Z

Quality Gate failed

Failed conditions
D Security Rating on New Code (required ≥ C)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

…ne-tools into feature/engine_dast_nu

Solve comments and improve engine dast unit test

Update JWT unit tests

Update nuclei tool tests

test run_tool was updated

Refactor test_nuclei_tool

sonarcloud · 2024-10-16T00:03:40Z

Quality Gate failed

Failed conditions
D Security Rating on New Code (required ≥ C)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

Gaviria9601 · 2024-10-18T22:30:31Z

example_remote_config_local/engine_dast/ConfigTool.json

Update the file example_remote_config_local/engine_core/ConfigTool.json with the EXTRA_TOOLS property in the ENGINE_DAST block

Gaviria9601 · 2024-10-18T22:32:10Z

.gitignore

Delete .gitkeep files where it is not needed

Gaviria9601 · 2024-10-18T22:42:21Z

example_remote_config_local/engine_dast/ConfigTool.json

+    "MESSAGE_INFO_DAST": "If you have doubts, visit https://forum.example",
+    "NUCLEI": {
+        "VERSION": "2.3.296",
+        "EXCLUSIONS_PATH": "/engine_dast/Exclusions.json",


delete EXCLUSIONS_PATH, it not used

Gaviria9601 · 2024-10-18T22:43:06Z

tools/devsecops_engine_tools/engine_dast/src/domain/model/config_tool.py

+class ConfigTool:
+    def __init__(self, json_data, tool):
+        self.version = json_data[tool].get("VERSION")
+        self.exclusions_path = json_data[tool].get("EXCLUSIONS_PATH")


delete exclusions_path, it not used

Gaviria9601 · 2024-10-18T22:54:57Z

.../devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/nuclei/nuclei_tool.py

+
+    def check_install_tool(self) -> any:
+        command = "nuclei --version"
+        result = subprocess.run(command, capture_output=True, shell=True)


check the installation with subprocess.run( ["nuclei", "./trivy"] and handle the response with the return code.

Gaviria9601 · 2024-10-18T22:59:05Z

.../devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/nuclei/nuclei_tool.py

+        return 0
+
+    def run_install(self):
+        download = subprocess.run(


download with requests.get and release according to platform.system()

Gaviria9601 · 2024-10-18T23:00:29Z

.../devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/nuclei/nuclei_tool.py

+            logger.error(f"Error downloading {self.TOOL} binary")
+            return -1
+
+        unzip = subprocess.run(


instead use Utils.unzip_file

Gaviria9601 · 2024-10-18T23:01:22Z

.../devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/nuclei/nuclei_tool.py

+            logger.error(f"Error Unzipping {self.TOOL} binary")
+            return -1
+
+        make_exe = subprocess.run(


run it only with unix operating systems

Gaviria9601

Review new comments

Gaviria9601 · 2024-10-18T23:15:12Z

tools/devsecops_engine_tools/engine_dast/src/infrastructure/helpers/file_generator_tool.py

+
+
+def generate_file_from_tool(tool, result_list, rules_doc):
+    if tool.lower() == "nuclei":


nuclei not it necesary. If this is for JWT, use a generic format or SARIF to send to defect dojo

.../devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/nuclei/nuclei_tool.py

russbelln added 6 commits May 7, 2024 17:44

integration engine dast

890b600

integration engine dast

13dab0a

integration engine dast

c79c6f6

delete lcoal config files

b331501

Merge branch 'trunk' of https://github.com/bancolombia/devsecops-engi…

18127eb

…ne-tools into feature/engine_dast_nu

pull new changes engine risk

31e1374

github-advanced-security bot found potential problems May 17, 2024

View reviewed changes

russbelln added 9 commits May 21, 2024 22:43

adjust modules engine dast

40131a5

remove duplicate code

86f00c7

ajust unit test

8f48e3f

adjust requirements

9354113

adjust requirements

3b65b2e

adjust unit tests runner_engine_dast

d034dd9

adjust unit tests dast_scan

f8618b1

adjust unit test oauth and jwt

cf97123

adjust unit test

bc1a6d5

russbelln added 8 commits July 22, 2024 10:06

Merge branch 'trunk' of https://github.com/bancolombia/devsecops-engi…

0c2dbdd

…ne-tools into feature/engine_dast_nu

Adjust changes PR

fce5ff0

update PR

ecc5a25

Merge branch 'trunk' of https://github.com/bancolombia/devsecops-engi…

a952b86

…ne-tools into feature/engine_dast_nu

Merge trunk engine dast

6cf83d6

adjust dast unit tests

09a40ce

adjust unit test engine dast

deee82a

adjust test_nuclei_tool test

9821a24

russbelln changed the title ~~Feature/engine dast nu~~ feat(engine dast) Sep 5, 2024

russbelln changed the title ~~feat(engine dast)~~ feat(engine dast): new dast scanning engine Sep 5, 2024

russbelln changed the title ~~feat(engine dast): new dast scanning engine~~ feat(engine_dast): new dast scanning engine Sep 5, 2024

russbelln changed the title ~~feat(engine_dast): new dast scanning engine~~ feat(engine_dast): new dast scanning engine. Sep 5, 2024

russbelln had a problem deploying to release October 15, 2024 21:01 — with GitHub Actions Failure

test(engine_dast): ✅ Update engine dast tests

db5d576

Solve comments and improve engine dast unit test

russbelln had a problem deploying to release October 15, 2024 22:38 — with GitHub Actions Failure

test(engine_dast): ✅ Adjust jwt tests

7b06ec7

Update JWT unit tests

russbelln had a problem deploying to release October 15, 2024 23:03 — with GitHub Actions Failure

test(engine_dast): ✅ Adjust engine dast test

07841e4

Update nuclei tool tests

russbelln had a problem deploying to release October 15, 2024 23:21 — with GitHub Actions Failure

test(engine_dast): ✅ Adjust engine dast tests

36ffb77

Update nuclei tool tests

russbelln had a problem deploying to release October 15, 2024 23:41 — with GitHub Actions Failure

russbelln had a problem deploying to release October 15, 2024 23:42 — with GitHub Actions Failure

test(engine_dast): ✅ Adjust nuclei tool tests

033d427

test run_tool was updated

russbelln had a problem deploying to release October 15, 2024 23:55 — with GitHub Actions Failure

russbelln had a problem deploying to release October 15, 2024 23:56 — with GitHub Actions Failure

test(engine_dast): ✅ Adjust nuclei tool tests

fd70543

Refactor test_nuclei_tool

russbelln temporarily deployed to release October 16, 2024 00:01 — with GitHub Actions Inactive

Gaviria9601 reviewed Oct 18, 2024

View reviewed changes

.gitignore

Copy link

Contributor

Gaviria9601 Oct 18, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Delete .gitkeep files where it is not needed

Gaviria9601 reviewed Oct 18, 2024

View reviewed changes

Gaviria9601 reviewed Oct 21, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(engine_dast): new dast scanning engine. #140

feat(engine_dast): new dast scanning engine. #140

russbelln commented May 7, 2024 •

edited

Loading

github-advanced-security bot commented May 17, 2024

sonarcloud bot commented May 30, 2024

sonarcloud bot commented Oct 16, 2024

Gaviria9601 Oct 18, 2024

Gaviria9601 Oct 18, 2024

Gaviria9601 Oct 18, 2024

Gaviria9601 Oct 18, 2024

Gaviria9601 Oct 18, 2024

Gaviria9601 Oct 18, 2024

Gaviria9601 Oct 18, 2024

Gaviria9601 Oct 18, 2024

Gaviria9601 left a comment

Gaviria9601 Oct 18, 2024



		def generate_file_from_tool(tool, result_list, rules_doc):
		if tool.lower() == "nuclei":

feat(engine_dast): new dast scanning engine. #140

Are you sure you want to change the base?

feat(engine_dast): new dast scanning engine. #140

Conversation

russbelln commented May 7, 2024 • edited Loading

Description

Checklist:

github-advanced-security bot commented May 17, 2024

sonarcloud bot commented May 30, 2024

Quality Gate failed

sonarcloud bot commented Oct 16, 2024

Quality Gate failed

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Gaviria9601 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

russbelln commented May 7, 2024 •

edited

Loading