Static Application Security Testing (SAST)
Are automated tools for code analysis.
links
Semgrep : is a fast, static analysis tool powered by an open-source engine for finding bugs, detecting vulnerabilities, and enforcing code standards.
E.g Psalm
#psalm.xml
<?xml version="1.0"?>
<psalm
errorLevel="3"
resolveFromConfigFile="true"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="https://getpsalm.org/schema/config"
xsi:schemaLocation="https://getpsalm.org/schema/config vendor/vimeo/psalm/config.xsd"
findUnusedBaselineEntry="true"
>
<projectFiles>
<directory name="html/" />
<ignoreFiles>
<directory name="vendor" />
</ignoreFiles>
</projectFiles>
</psalm>
#executing
./vendor/bin/psalm --no-cache
# it will pinpoint possible security issues
./vendor/bin/psalm --no-cache --taint-analysis
Dynamic Application Security Testing (DAST)
%%{init: {"flowchart": {"nodeSpacing": 60, "rankSpacing": 80, "padding": 18}, "themeVariables": {"fontSize": "24px"}}}%%
flowchart TB
subgraph DEV["🖥️ Dev"]
direction LR
P1["01 · Plan"] --> P2["02 · Code"] --> P3["03 · Build"] --> P4["04 · Test"]
end
subgraph OPS["☁️ Ops"]
direction LR
P5["05 · Release"] --> P6["06 · Deploy"] --> P7["07 · Operate"] --> P8["08 · Monitor"]
end
P4 --> P5
P4 -.-> DAST["🔎 DAST"]
P8 -->|feedback loop| P1It is common to use automated DAST during the test phases
Is the process of testing a running instance of a web application for weaknesses and vulnerabilities. It focuses on a black-box testing approach where vulnerabilities are found just like a regular attacker would find them.
There are two ways in which DAST can be performed:
- Manual DAST: Manually perform tests against an application to check for vulnerabilities.
- Automatic DAST: An automated tool will scan the web application for vulnerabilities.
A DAST tool will perform at least the two following tasks against the target website:
- Spidering/Crawling: The tool will navigate through the web app, trying to map the application and identify a list of pages and parameters that can be attacked.
- Vulnerability Scanning: The tool will try to launch attack payloads against the identified pages and parameters. The user can typically customise the type of attacks to include only the ones relevant to the target application.
links:
- ZAP: A free and open-source web application security scanner. It is a powerful tool that penetration testers and security professionals can use to test the security of web applications.
Checking APIs with ZAP
ZAP can import APIs defined by OpenAPI (formerly Swagger), SOAP or GraphQL. Depending on the API I am testing, I might get one of these formats from the development team.
Here I have the part of the specification on how to interact with /asciiart/{art_id}:
swagger.json
"/asciiart/{art_id}": {
"get": {
"parameters": [
{
"description": "art id",
"in": "path",
"name": "art_id",
"required": true,
"type": "string"
}
],
"responses": {
"default": {
"description": "",
"schema": {
"$ref": "#/definitions/ASCIIArt"
}
}
}
}
}
The file indicates that I can do calls to /asciiart/{art_id} using the GET method by sending the art_id parameter in the URL, which is a string. I can find similar definitions for other paths as /asciiart/generate or /asciiart/add.
UI interface: http://localhost:8081/swagger-ui
Importing OpenAPI definitions in ZAP
url: http://localhost:8081/swagger.json
Import -> Import an OpenAPI definition from a URL
Scanning the API
To run a scan against the API, right-click its URL and select Attack -> Active Scan.
Integrating DAST into the development pipeline
To integrate ZAP in my pipeline, I will use zap2docker, a dockerized version of ZAP proxy built with automation as its primary purpose. The full documentation for zap2docker can be found here.
To install zap2docker, it can be pull it from Docker Hub