Skip to content

Commit 2c3781a

Browse files
mkondamkonda
authored
Merge branch 'master' into add-bundle-audit-tests
2 parents d55ddf7 + 53bbad7 commit 2c3781a

File tree

7 files changed

+245
-3
lines changed

7 files changed

+245
-3
lines changed

‎docs/dynamic_task.md‎

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,43 @@ Replace `report.json` and `mapping.json` with the paths to the relevant files.
3838
## Built-In Tools
3939
The dynamic task support built-in mappings, that are shipped with Glue.
4040
Those mapping files aims to help others to use the mapping your created.
41-
To use a built-in tools run Glue in the following format:
41+
42+
### MobSF
43+
44+
To parse MobSF report, use the following format:
4245
```
4346
ruby bin/glue -t Dynamic -T report.json --mapping-file mobsf
4447
```
45-
This will look for a file with the name `mobsf.json` under this [folder](/lib/glue/mappings/).
48+
where `report.json` is your report
49+
50+
### Zaproxy
51+
To parse Zaproxy report, you first need to generate it by using the API:
52+
```
53+
curl --fail $PROXY_URL/OTHER/core/other/jsonreport/?formMethod=GET --output report.json
54+
```
55+
Than, use [jq](https://stedolan.github.io/jq/) to flatten the report so Glue can parse it:
56+
```
57+
jq '{ "@name" : .site."@name",
58+
"alerts":
59+
[.site.alerts[] as $in
60+
| $in.instances[] as $h
61+
| $in
62+
| $h * $in
63+
| {
64+
"description": $in.desc,
65+
"source": "URI: \($h.uri) Method: \($h.method)",
66+
"detail": "\($in.name) \n Evidence: \($h.evidence) \n Solution: \($in.solution) \n Other info: \($in.otherinfo) \n Reference: \($in.reference)",
67+
"severity": $in.riskdesc | split(" ") | .[0],
68+
"fingerprint": "\($in.pluginid)_\($h.uri)_\($h.method)"
69+
}
70+
]
71+
} ' report.json > output.json
72+
```
73+
Now use Glue to process the report:
74+
```
75+
ruby bin/glue -t Dynamic -T report.json --mapping-file zaproxy
76+
```
77+
You can modify the jq pattern to modify the fields in Glue's results. For example, you might want to remove `otherinfo`, or use something else for the fingerprint.
4678
## Adding a new tool
4779
First, create the mapping file.
4880
After you have a working mapping file, open a PR and add it under `/lib/glue/mappings/`.

‎lib/glue/mappings/snyk.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"task_name": "Snyk",
3+
"app_name": "path",
4+
"mappings": [
5+
{
6+
"key": "vulnerabilities",
7+
"properties": {
8+
"description": "title",
9+
"detail": "description",
10+
"source": "packageName",
11+
"severity": "severity",
12+
"fingerprint": "id"
13+
}
14+
}
15+
]
16+
}

‎lib/glue/mappings/zaproxy.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"task_name": "OWASP Zaproxy",
3+
"app_name": "@name",
4+
"mappings": [
5+
{
6+
"key": "alerts",
7+
"properties": {
8+
"description": "description",
9+
"detail": "detail",
10+
"source": "source",
11+
"severity": "severity",
12+
"fingerprint": "fingerprint"
13+
}
14+
}
15+
]
16+
}

‎lib/glue/tasks/base_task.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ def severity sev
7575
return 1 if @severity_filter[:low].include?(sev.strip.chomp.downcase)
7676
return 2 if @severity_filter[:medium].include?(sev.strip.chomp.downcase)
7777
return 3 if @severity_filter[:high].include?(sev.strip.chomp.downcase)
78-
puts "unsupperted severity found: " + sev
78+
Glue.warn "unsupperted severity found: " + sev
7979
return 0
8080
end
8181

‎spec/tasks/dynamic/dynamic_spec.rb‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,4 +131,49 @@ def get_dynamic_task_buildin_mapping(report_path, mapping_name)
131131
expect(finding.task).to eq("MobSF")
132132
end
133133
end
134+
135+
# The tests used the report after transformed with JQ, see the documentation for more details
136+
context "zaproxy" do
137+
let(:task) { get_dynamic_task_buildin_mapping "tools_samples/zaproxy.json", "zaproxy"}
138+
subject(:task_findings) { task.findings }
139+
before do
140+
task.run
141+
end
142+
it "should produce one finding" do
143+
should have(1).items
144+
end
145+
146+
it "should fill all the required fields" do
147+
finding = subject[0]
148+
expect(finding.severity).to eq(1)
149+
expect(finding.description).to eq("<p>Base64 encoded data was disclosed by the application/web server</p>")
150+
expect(finding.detail).to eq("Base64 Disclosure \n Evidence: DxyPP_YQ6qdWluCCz93Xs1CeJPvg \n Solution: <p>Manually confirm that the Base64 data does not leak sensitive information, and that the data cannot be aggregated/used to exploit other vulnerabilities.</p> \n Other info: <p>\\x000f\\x001c�?�\\x0010�V���Re\\x000c��9�7C\\x001b \\x0011Ű�\\x0004?a\tP�\\x0017���\u007f@]ۺ�\\x0005\\x0007��7\\x0006\\x000e���\\x0019�,�D[�n���_)��X�w��&^���3l����'�~h?��O\\x0011�H����΅\\x001c��ޕ�Bi|��>\\x0007\u007fŽ:�-QY(\\x0016</p><p>��A|��9��E��%&\\x0011�]�j\\x001c!��o�\\x000e�\\x0014԰�L�\\x0000j:\\x0008V:��]L����փԫ�o$\\x0003����KՆn��5�T_P�ͭ�w����l$\\x000fU���+vq\\x001e\\x001b& P\n7+���u9�\\x001e��tN����+\\x0003�X�R$\\,��{5\t�O</p> \n Reference: <p>https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure</p><p>http://projects.webappsec.org/w/page/13246936/Information%20Leakage</p>")
151+
expect(finding.source).to eq("URI: http://api:9999/ Method: POST")
152+
expect(finding.fingerprint).to eq("10094_http://api:9999/_POST")
153+
expect(finding.appname).to eq("http://api:9999")
154+
expect(finding.task).to eq("OWASP Zaproxy")
155+
end
156+
end
157+
158+
context "snyk" do
159+
let(:task) { get_dynamic_task_buildin_mapping "tools_samples/snyk.json", "snyk"}
160+
subject(:task_findings) { task.findings }
161+
before do
162+
task.run
163+
end
164+
it "should produce one finding" do
165+
should have(2).items
166+
end
167+
168+
it "should fill all the required fields" do
169+
finding = subject[0]
170+
expect(finding.severity).to eq(2)
171+
expect(finding.description).to eq("Denial of Service (DoS)")
172+
expect(finding.detail).to eq("description")
173+
expect(finding.source).to eq("Microsoft.AspNetCore.All")
174+
expect(finding.fingerprint).to eq("SNYK-DOTNET-MICROSOFTASPNETCOREALL-60258")
175+
expect(finding.appname).to eq("dummy/obj")
176+
expect(finding.task).to eq("Snyk")
177+
end
178+
end
134179
end

‎spec/tasks/dynamic/targets/tools_samples/snyk.json‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
{
2+
"ok": false,
3+
"vulnerabilities": [
4+
{
5+
"title": "Denial of Service (DoS)",
6+
"credit": [
7+
"Unknown"
8+
],
9+
"packageName": "Microsoft.AspNetCore.All",
10+
"language": "dotnet",
11+
"packageManager": "nuget",
12+
"description": "description",
13+
"identifiers": {
14+
"CWE": [
15+
"CWE-400"
16+
],
17+
"CVE": []
18+
},
19+
"semver": {
20+
"unaffected": "",
21+
"vulnerable": "[,2.0.9), [2.1.0, 2.1.2)"
22+
},
23+
"patches": [],
24+
"cvssScore": 6.5,
25+
"severity": "medium",
26+
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
27+
"disclosureTime": "2018-07-18T21:00:00.000Z",
28+
"publicationTime": "2018-07-26T11:23:24.744Z",
29+
"modificationTime": "2018-07-25T11:23:46.125Z",
30+
"creationTime": "2018-07-25T11:23:46.125Z",
31+
"id": "SNYK-DOTNET-MICROSOFTASPNETCOREALL-60258",
32+
"from": [
33+
"[email protected]"
34+
],
35+
"upgradePath": [],
36+
"version": "2.0.5",
37+
"name": "Microsoft.AspNetCore.All",
38+
"isUpgradable": false,
39+
"isPatchable": false
40+
},
41+
{
42+
"title": "Privilege Escalation",
43+
"credit": [
44+
"Unknown"
45+
],
46+
"language": "dotnet",
47+
"packageManager": "nuget",
48+
"packageName": "Microsoft.AspNetCore.HttpOverrides",
49+
"description": "description",
50+
"semver": {
51+
"vulnerable": "[,2.0.2)",
52+
"unaffected": ""
53+
},
54+
"identifiers": {
55+
"CVE": [
56+
"CVE-2018-0787"
57+
],
58+
"CWE": [
59+
"CWE-20"
60+
]
61+
},
62+
"patches": [],
63+
"cvssScore": 8.8,
64+
"severity": "high",
65+
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
66+
"modificationTime": "2017-01-25T13:19:47.018Z",
67+
"creationTime": "2017-01-25T13:19:47.018Z",
68+
"disclosureTime": "2017-01-25T13:19:47.018Z",
69+
"publicationTime": "2018-05-02T14:33:27.159Z",
70+
"id": "SNYK-DOTNET-MICROSOFTASPNETCOREHTTPOVERRIDES-60238",
71+
"from": [
72+
"[email protected]"
73+
],
74+
"upgradePath": [],
75+
"version": "2.0.1",
76+
"name": "Microsoft.AspNetCore.HttpOverrides",
77+
"isUpgradable": false,
78+
"isPatchable": false
79+
}
80+
],
81+
"dependencyCount": 322,
82+
"org": "soluto-tel-aviv",
83+
"licensesPolicy": {
84+
"severities": {
85+
"MS-RL": "medium",
86+
"EPL-1.0": "medium",
87+
"GPL-2.0": "high",
88+
"GPL-3.0": "high",
89+
"MPL-1.1": "medium",
90+
"MPL-2.0": "medium",
91+
"AGPL-1.0": "high",
92+
"AGPL-3.0": "high",
93+
"CDDL-1.0": "medium",
94+
"LGPL-2.0": "medium",
95+
"LGPL-2.1": "medium",
96+
"LGPL-3.0": "medium",
97+
"CPOL-1.02": "high",
98+
"LGPL-2.1+": "medium",
99+
"LGPL-3.0+": "medium",
100+
"SimPL-2.0": "high",
101+
"Artistic-1.0": "medium",
102+
"Artistic-2.0": "medium"
103+
}
104+
},
105+
"isPrivate": true,
106+
"packageManager": "nuget",
107+
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.12.0\nignore: {}\npatch: {}\n",
108+
"ignoreSettings": {
109+
"adminOnly": false,
110+
"reasonRequired": true,
111+
"disregardFilesystemIgnores": false
112+
},
113+
"summary": "88 vulnerable dependency paths",
114+
"filesystemPolicy": false,
115+
"filtered": {
116+
"ignore": [],
117+
"patch": []
118+
},
119+
"uniqueCount": 18,
120+
"path": "dummy/obj"
121+
}

‎spec/tasks/dynamic/targets/tools_samples/zaproxy.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"@name": "http://api:9999",
3+
"alerts": [
4+
{
5+
"description": "<p>Base64 encoded data was disclosed by the application/web server</p>",
6+
"source": "URI: http://api:9999/ Method: POST",
7+
"detail": "Base64 Disclosure \n Evidence: DxyPP_YQ6qdWluCCz93Xs1CeJPvg \n Solution: <p>Manually confirm that the Base64 data does not leak sensitive information, and that the data cannot be aggregated/used to exploit other vulnerabilities.</p> \n Other info: <p>\\x000f\\x001c�?�\\x0010�V���Re\\x000c��9�7C\\x001b \\x0011Ű�\\x0004?a\tP�\\x0017���\u007f@]ۺ�\\x0005\\x0007��7\\x0006\\x000e���\\x0019�,�D[�n���_)��X�w��&^���3l����'�~h?��O\\x0011�H����΅\\x001c��ޕ�Bi|��>\\x0007\u007fŽ:�-QY(\\x0016</p><p>��A|��9��E��%&\\x0011�]�j\\x001c!��o�\\x000e�\\x0014԰�L�\\x0000j:\\x0008V:��]L����փԫ�o$\\x0003����KՆn��5�T_P�ͭ�w����l$\\x000fU���+vq\\x001e\\x001b& P\n7+���u9�\\x001e��tN����+\\x0003�X�R$\\,��{5\t�O</p> \n Reference: <p>https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure</p><p>http://projects.webappsec.org/w/page/13246936/Information%20Leakage</p>",
8+
"severity": "Informational",
9+
"fingerprint": "10094_http://api:9999/_POST"
10+
}
11+
]
12+
}

0 commit comments

Comments
 (0)