Download to read offline
![DAST in CI/CD
Olga Sviridova, Application Security Engineer
How it works?
doActiveScan (java.lang.String host, int port, boolean use Https, byte[] request)
This method can be used to send an HTTP request to the Burp Scanner tool to perform an active vulnerability scan.](https://image.slidesharecdn.com/03-200219092842/75/DAST-CI-CD-14-2048.jpg)
Uploaded byMail.ru Group
DAST в CI/CD, Ольга Свиридова
The document discusses the implementation and benefits of Dynamic Application Security Testing (DAST) tools in Continuous Integration/Continuous Deployment (CI/CD) environments, highlighting workflows and popular solutions such as Burp Suite Pro and OWASP ZAP. It emphasizes the need for automated security testing to identify vulnerabilities throughout the development process while also providing technical details on configurations for various DAST tools. Additionally, it covers how DAST can be integrated with CI systems and explores the nuances of detecting SQL injections using these tools.
More Related Content
Similar to DAST в CI/CD, Ольга Свиридова
DAST в CI/CD, Ольга Свиридова
- 1. DAST in CI/CD OlgaSviridova, Application Security Engineer
- 2. WHOAMI Olga Sviridova, ECOMMPAYSecurity Team Telegram: @turbobarsuchiha DAST in CI/CD Olga Sviridova, Application Security Engineer
- 3. DAST in CI/CD OlgaSviridova, Application Security Engineer DAST A dynamic application security testing (DAST) tool is a program which communicates with a web application through the web front-end in order to identify potential security vulnerabilities in the web application and architectural weaknesses. It performs a black-box test.
- 4. Problems • Security testingis a bottleneck for SDL • Security scan starts manually • Security and automated testing guys do similar work • Finding simple security bugs can be automated DAST in CI/CD Olga Sviridova, Application Security Engineer
- 5. DAST in CI/CD OlgaSviridova, Application Security Engineer Most Popular Solutions
- 6. DAST in CI/CD OlgaSviridova, Application Security Engineer Typical Workflow Developers team QA team Product owner Security team Check a staging report back
- 7. DAST in CI/CD OlgaSviridova, Application Security Engineer Developers team QA team Product owner Security team sharing automated tests for a simple security check from deployment to deployment Check a staging report back report back Our Workflow
- 8. DAST in CI/CD OlgaSviridova, Application Security Engineer Architecture of DAST in CI/CD CI Automated Testing WEB APP run Ok 1step POST /login HTTP/1.1 host: example.com {email: "a@test.com", pass:»qwer"} Ok
- 9. DAST in CI/CD OlgaSviridova, Application Security Engineer CI WEB APP Architecture of DAST in CI/CD run with set proxy DAST with Proxy Automated testing Ok scope is being formed 1step2step POST /login HTTP/1.1 host: example.com {email: "a@test.com", pass:»qwer"} DAST in CI/CD Olga Sviridova, Application Security Engineer CI
- 10. DAST in CI/CD OlgaSviridova, Application Security Engineer Architecture of DAST in CI/CD run security scan with config DAST with Proxy WEB APP CI are done? report 3step POST /login HTTP/1.1 host: example.com {email: «a@test.com1' or ‘1'='1'--", pass:»qwer"} HTTP/1.1 200 OK
- 11. DAST in CI/CD OlgaSviridova, Application Security Engineer Architecture of DAST in CI/CD run ok QA tests run with set proxy ok run security scan with config are done? report 1step2step3step CI Automated testing WEB APP Automated testing DAST with Proxy scope is being formed
- 12. DAST in CI/CD OlgaSviridova, Application Security Engineer Burp Suite Pro in CI/CD 3 solutions Burp Rest API Burp molly scanner Burp API
- 13. DAST in CI/CD OlgaSviridova, Application Security Engineer Burp Suite Pro 1.7.x Burp-rest-api Burp molly scaner Burp Suite Pro 2.x Burp API Can run "active scan" Can run Crawler and Audit Burp Suite Pro in CI/CD
- 14. DAST in CI/CD OlgaSviridova, Application Security Engineer How it works? doActiveScan (java.lang.String host, int port, boolean use Https, byte[] request) This method can be used to send an HTTP request to the Burp Scanner tool to perform an active vulnerability scan.
- 15. DAST in CI/CD OlgaSviridova, Application Security Engineer Burp Rest Api • Doyensec LLC (github.com/doyensec/burp-rest-api) • Easy Swagger UI for REST • Run burp-rest-api with headless Burp Suite Professional (1.7.x) • If you like, you can add Burp extensions similar to Burp-Molly-Pack or Active Scan++, etc.
- 16. DAST in CI/CD OlgaSviridova, Application Security Engineer • Create a virtual machine or docker container with Burp Pro and Burp-Rest-Api. • HTTP-proxy and REST server should be available for automated tests and CI system. • If you want to use extensions, add them to user configuration before starting. • You can create project config on your local instance Burp Suite Pro. Burp Rest Api
- 17. DAST in CI/CD OlgaSviridova, Application Security Engineer Project config for Burp Rest API • Use Burp Pro on your PC • Set and save your project options, such as: • Session handling rules • Burp Collaborator server • Scope • etc. • Set and save your User options, such as: • extensions
- 18. DAST in CI/CD OlgaSviridova, Application Security Engineer Verification of Session Validity
- 19. DAST in CI/CD OlgaSviridova, Application Security Engineer Verification of Session Validity
- 20. DAST in CI/CD OlgaSviridova, Application Security Engineer UI Burp Rest API
- 21. DAST in CI/CD OlgaSviridova, Application Security Engineer Reports from Burp Rest API HTML or XML
- 22. DAST in CI/CD OlgaSviridova, Application Security Engineer Molly Scanner from Yandex • Burp Suite Professional (1.7.x) • No UI • Burp molly pack • Deduplication mechanism • XML-report
- 23. DAST in CI/CD OlgaSviridova, Application Security Engineer OWASP ZAP and API • Open-source DAST with API • Extensive documentation for integration https://www.zaproxy.org/docs/api/ • Easy to understand manual for local regression testing.
- 24. DAST in CI/CD OlgaSviridova, Application Security Engineer Docker for OWASP ZAP with API • docker run -u zap -p 8080:8080 -i owasp/zap2docker-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.key=MY_SECRET_KEY -config api.addrs.addr.name=.* - config api.addrs.addr.regex=true • Or -config api.disablekey=true (use the options in private network only)
- 25. DAST in CI/CD OlgaSviridova, Application Security Engineer Config OWASP ZAP • Use OWASP ZAP on your PC • Set and save your context options, such as: • Auth Scripts • Include/Exclude in context • Technology • Upload your context with the ZAP API
- 26. DAST in CI/CD OlgaSviridova, Application Security Engineer Run OWASP ZAP Through the API • Check Context ID • If you like, configure scanning policies • Run the active scan with ContextId (if you like, you can run spider or ajax-spider before the active scan)
- 27. DAST in CI/CD OlgaSviridova, Application Security Engineer Get the report in a file format you like (xml, html, json)
- 28. DAST in CI/CD OlgaSviridova, Application Security Engineer Two different realizations A small speech about the search of simple sql-injections by DAST
- 29. DAST in CI/CD OlgaSviridova, Application Security Engineer How Burp Pro detects an SQL-injection #2 Request #1 Request
- 30. DAST in CI/CD OlgaSviridova, Application Security Engineer How ZAP detects an SQL-injection #1 Request #2 Request ZAP detected a sql-injection, because we used an invalid email in the request
- 31. DAST in CI/CD OlgaSviridova, Application Security Engineer How ZAP doesn’t detect a SQL-injection #2 Request#1 Request ZAP could not detect a sql-injection, because we used a valid email in the request
- 32. DAST in CI/CD OlgaSviridova, Application Security Engineer Configuration Selenium Webdriver profile = FirefoxProfile() profile.set_preference('network.proxy.type', 1) profile.set_preference("network.proxy.http", PROXY_HOST) profile.set_preference("network.proxy.http_port", PROXY_PORT) profile.set_preference("network.proxy.ssl", PROXY_HOST) profile.set_preference("network.proxy.ssl_port", PROXY_PORT) #profile.accept_untrusted_certs = True profile.update_preferences() proxy = Proxy() proxy.proxy_type = ProxyType.MANUAL proxy.http_proxy = "http://url:port" proxy.ssl_proxy = «http://url:port" ... capabilities = webdriver.DesiredCapabilities.CHROME proxy.add_to_capabilities(capabilities) options.add_argument("--ignore-certificate-errors")
- 33. DAST in CI/CD OlgaSviridova, Application Security Engineer Also… If you are test application deployed on a local machine, you can also use DAST after an automated tests.
- 34. DAST in CI/CD OlgaSviridova, Application Security Engineer Bonus A little speech about Burp Suite Enterprise
- 35. DAST in CI/CD OlgaSviridova, Application Security Engineer Burp Suite Enterprise • No proxy, No macros, No insertion Point • It’s easy to add config from Burp Suite Professional • Create Jira ticket, CI integrations, Scalable agents • Nice dashboard
- 36. DAST in CI/CD OlgaSviridova, Application Security Engineer
- 37. DAST in CI/CD OlgaSviridova, Application Security Engineer
- 38. DAST in CI/CD OlgaSviridova, Application Security Engineer
- 39. DAST in CI/CD OlgaSviridova, Application Security Engineer
- 40. DAST in CI/CD OlgaSviridova, Application Security Engineer –portswigger “Enterprise is aimed at an entirely different audience that requires more of an all-in-one solution for their testing needs and are not professional testers themselves.”
- 41. DAST in CI/CD OlgaSviridova, Application Security Engineer Links https://github.com/yandex/burp-molly-scanner https://github.com/vmware/burp-rest-api https://www.zaproxy.org/docs/api/ https://www.youtube.com/watch?v=pQ4v4H7bHLE https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Zaitov_Automation of Web Application Scanning with Burp Suite.pdf
- 42.