devopstestlab/bdd-security repository overview

The framework is essentially a set of Cucumber-JVM features that are pre-wired with :

• Selenium/WebDriver,
• OWASP ZAP, https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project⁠
  • Some of the built in features include: Intercepting proxy server, Traditional and AJAX Web crawlers, Automated scanner, Passive scanner, Forced browsing, Fuzzer, WebSocket support, Scripting languages, and Plug-n-Hack support. It has a plugin-based architecture and an online ‘marketplace’ which allows new or updated features to be added.
• SSLyze https://github.com/nabla-c0d3/sslyze⁠
  • Fast and powerful SSL/TLS server scanning library
• Tennable's Nessus scanner. http://www.tenable.com/products/nessus-vulnerability-scanner⁠

⁠Usage

cd example

Run a webserver for a demo :

java -jar ropeytasks.jar

Execute a specific feature (" '"authentication") :

./gradlew -Dcucumber.options="--tags @authentication --tags ~@skip"

The test results are stored in : ./build/reports/cucumber/pretty/feature-overview.html

To execute all the features including ZAP scanning:

./gradlew

To select a browser ("Chrome" for example), choose the Chrome driver binary in the config.xml file :

<defaultDriver path="src/test/resources/drivers/chromedriver-mac">Chrome</defaultDriver>

To scan with OWASP ZAP :

• configure the application to login and navigate through Selenium steps in the Java class defined in the 'class' tag in config.xml :
  • <class>net.continuumsecurity.MyComplexApp</class>
  • This class should extend the WebApplication class and implement the Navigable interface :

   public class MyComplexApp extends WebApplication implements INavigable {

    public void navigate() {
        driver.get(Config.getInstance().getBaseUrl() + "user/login");
        UserPassCredentials creds = new UserPassCredentials(Config.getInstance().getDefaultCredentials());
        driver.findElement(By.id("username")).clear();
        driver.findElement(By.id("username")).sendKeys(creds.getUsername());
        driver.findElement(By.id("password")).clear();
        driver.findElement(By.id("password")).sendKeys(creds.getPassword());
        driver.findElement(By.name("_action_login")).click();
        
        //Click on the "tasks" link
        findAndWaitForElement(By.linkText("Tasks")).click();
        
        //Enter a search query
        driver.findElement(By.id("q")).clear();
        driver.findElement(By.id("q")).sendKeys("test");
        driver.findElement(By.id("search")).click();
    }

• to read values from the config file, use : Config.getInstance()
• Configure the following values :

  	<baseUrl>http://www.example.com/</baseUrl>
  	<defaultUsername>bob</defaultUsername>
  	<defaultPassword>password</defaultPassword>

To launch the ZAP scanning tests:

./gradlew -Dcucumber.options="--tags @app_scan --tags ~@skip" test

The ./src/test/resources/features/app_scan.feature file will be launched.

To test SSL :

• Install the SSLyze package
• edit the config.xml file :

 <sslyze>
    <path>/opt/sslyze/sslyze_cli.py</path>
    <option>--regular</option>
 </sslyze>

• run the SSL tests:

./gradlew -Dcucumber.options="--tags @ssl" test

To run a specific feature, specify its tag:

./gradle -Dcucumber.options="--tags @authentication"

To skip some tests, spefiy them with the proprty "tags" :

./gradle -Dcucumber.options="--tags @authentication,@http_headers --tags ~@skip"

The results are :

• HTML Cucumber resulsts : build/reports/cucumber/pretty/feature-overview.html
• JSON Cucumber results : build/reports/cucumber/all_tests.json
• JUnit results : build/reports/junit/all_tests.xml

The JUnit resulsts can be integrated in the CI pipeline.

Integration in Jenkins :

• Create a Gradle build task
• set Cucumber options in the 'Tasks' section : -Dcucumber.options="--tags @authentication,@http_headers --tags ~@skip"
• Add a Post-Build Action to publish JUnit test results
• set the Test report XMLs to: build/reports/junit/*.xml

But you can prefer to use a plugin :

• Cucumber-JVM reports : https://github.com/jenkinsci/cucumber-reports-plugin⁠
• Bootstrap multi-test results report : https://wiki.jenkins-ci.org/display/JENKINS/Bootstraped+Multi+Test+Results+Report⁠

In this case, add a Post-Build Action : set the JSON reports path to: build/reports

With Docker :

Build : docker build --no-cache -t bdd-security .

• Run the webserver for demo :

java -jar ropeytasks.jar

(mais ne fonctionne que sur localhost)

• Copy the .attack files in the ../features directory.
• Set the Webserver IP address in the docker-compose.yml file.
• Run :

docker-compose up bdd-security