[{"_1":2,"_151":-5,"_152":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_130":131},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.r.$namespace.$reponame",{"_22":23,"_24":-5,"_25":11,"_26":11,"_27":28,"_29":30,"_31":-5,"_32":11,"_33":34,"_83":-5,"_84":85,"_123":-5,"_124":11,"_125":17,"_126":11,"_127":-5,"_128":129},"canonicalUrl","https://hub.docker.com/r/devopstestlab/bdd-security/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","devopstestlab","reponame","bdd-security","cloudBuildSource","isAutobuildsAvailable","repo",{"_35":36,"_37":38,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":50,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":28,"_68":69,"_74":11,"_75":76,"_80":28,"_81":82},"categories",[],"content_types",[39],"image","date_registered","2019-07-08T11:43:42.10173Z","description","","is_private","last_updated","2021-12-29T09:50:13.149869Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[51],"application/vnd.docker.container.image.v1+json","name","pull_count",695,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","The framework is essentially a set of Cucumber-JVM features that are pre-wired with :\n- Selenium/WebDriver,\n- OWASP ZAP, https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project\n - Some of the built in features include: Intercepting proxy server, Traditional and AJAX Web crawlers, Automated scanner, Passive scanner, Forced browsing, Fuzzer, WebSocket support, Scripting languages, and Plug-n-Hack support. It has a plugin-based architecture and an online ‘marketplace’ which allows new or updated features to be added.\n- SSLyze https://github.com/nabla-c0d3/sslyze\n\t- Fast and powerful SSL/TLS server scanning library\n- Tennable's Nessus scanner. http://www.tenable.com/products/nessus-vulnerability-scanner\n\n## Usage\n\n```\ncd example\n```\n\nRun a webserver for a demo :\n\n```\njava -jar ropeytasks.jar\n```\n\nExecute a specific feature (\" '\"authentication\") :\n\n```\n./gradlew -Dcucumber.options=\"--tags @authentication --tags ~@skip\"\n```\n\nThe test results are stored in : `./build/reports/cucumber/pretty/feature-overview.html`\n\nTo execute all the features including ZAP scanning:\n\n```\n./gradlew\n```\n\nTo select a browser (\"Chrome\" for example), choose the Chrome driver binary in the config.xml file :\n\n```\nChrome\n```\n\nTo scan with OWASP ZAP :\n- configure the application to login and navigate through Selenium steps in the Java class defined in the 'class' tag in config.xml :\n - `net.continuumsecurity.MyComplexApp`\n - This class should extend the WebApplication class and implement the Navigable interface :\n\n```\n public class MyComplexApp extends WebApplication implements INavigable {\n\n public void navigate() {\n driver.get(Config.getInstance().getBaseUrl() + \"user/login\");\n UserPassCredentials creds = new UserPassCredentials(Config.getInstance().getDefaultCredentials());\n driver.findElement(By.id(\"username\")).clear();\n driver.findElement(By.id(\"username\")).sendKeys(creds.getUsername());\n driver.findElement(By.id(\"password\")).clear();\n driver.findElement(By.id(\"password\")).sendKeys(creds.getPassword());\n driver.findElement(By.name(\"_action_login\")).click();\n \n //Click on the \"tasks\" link\n findAndWaitForElement(By.linkText(\"Tasks\")).click();\n \n //Enter a search query\n driver.findElement(By.id(\"q\")).clear();\n driver.findElement(By.id(\"q\")).sendKeys(\"test\");\n driver.findElement(By.id(\"search\")).click();\n }\n```\n\n - to read values from the config file, use : Config.getInstance()\n - Configure the following values :\n\n```\n \thttp://www.example.com/\n \tbob\n \tpassword\n```\n\nTo launch the ZAP scanning tests:\n\n```\n./gradlew -Dcucumber.options=\"--tags @app_scan --tags ~@skip\" test\n```\n\nThe `./src/test/resources/features/app_scan.feature` file will be launched.\n\nTo test SSL :\n- Install the SSLyze package\n- edit the config.xml file :\n\n```\n \n /opt/sslyze/sslyze_cli.py\n \n \n```\n\n- run the SSL tests:\n\n```\n./gradlew -Dcucumber.options=\"--tags @ssl\" test\n```\n\nTo run a specific feature, specify its tag:\n\n```\n./gradle -Dcucumber.options=\"--tags @authentication\"\n```\n\nTo skip some tests, spefiy them with the proprty \"tags\" :\n\n```\n./gradle -Dcucumber.options=\"--tags @authentication,@http_headers --tags ~@skip\"\n```\n\nThe results are :\n- HTML Cucumber resulsts : build/reports/cucumber/pretty/feature-overview.html\n- JSON Cucumber results : build/reports/cucumber/all_tests.json\n- JUnit results : build/reports/junit/all_tests.xml\n\nThe JUnit resulsts can be integrated in the CI pipeline.\n\nIntegration in Jenkins :\n- Create a Gradle build task\n- set Cucumber options in the 'Tasks' section : -Dcucumber.options=\"--tags @authentication,@http_headers --tags ~@skip\"\n- Add a Post-Build Action to publish JUnit test results\n- set the Test report XMLs to: build/reports/junit/*.xml\n\nBut you can prefer to use a plugin :\n- Cucumber-JVM reports : https://github.com/jenkinsci/cucumber-reports-plugin\n- Bootstrap multi-test results report : https://wiki.jenkins-ci.org/display/JENKINS/Bootstraped+Multi+Test+Results+Report\n\nIn this case, add a Post-Build Action : set the JSON reports path to: build/reports\n\nWith Docker :\n\n```\nBuild : docker build --no-cache -t bdd-security .\n```\n\n- Run the webserver for demo :\n\n```\njava -jar ropeytasks.jar\n```\n\n(mais ne fonctionne que sur localhost)\n\n- Copy the .attack files in the `../features` directory.\n- Set the Webserver IP address in the docker-compose.yml file.\n- Run :\n\n```\ndocker-compose up bdd-security\n```\n","has_starred","hub_user","immutable_tags_settings",{"_70":11,"_71":72},"enabled","rules",[73],".*","is_automated","permissions",{"_77":17,"_78":11,"_79":11},"read","write","admin","user","storage_size",2731649649,"orgData","recentTags",[86],{"_87":39,"_88":89,"_90":91,"_92":93,"_94":95,"_45":112,"_113":89,"_114":28,"_115":51,"_52":116,"_117":118,"_119":103,"_120":112,"_121":61,"_122":17},"content_type","creator",6923745,"full_size",760177651,"id",61407717,"images",[96],{"_97":98,"_99":100,"_101":43,"_102":103,"_104":105,"_106":107,"_108":43,"_109":-5,"_110":91,"_58":61,"_111":-5},"architecture","amd64","digest","sha256:93887d8295653ba937973278890ea28c14533194671c0a3ac31b9649397f1f0e","features","last_pulled","2026-09-01T21:26:42.585828093Z","last_pushed","2021-12-29T09:50:13Z","os","linux","os_features","os_version","size","variant","2021-12-29T09:50:12.828222Z","last_updater","last_updater_username","media_type","latest","repository",7372983,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_33":132,"_139":140,"_128":149,"_150":11},{"_35":133,"_37":134,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":135,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":28,"_68":136,"_74":11,"_75":138,"_80":28,"_81":82},[],[39],[51],{"_70":11,"_71":137},[73],{"_77":17,"_78":11,"_79":11},"tags",{"_141":59,"_142":-5,"_143":-5,"_144":145},"count","next","previous","results",[146],{"_87":39,"_88":89,"_90":91,"_92":93,"_94":147,"_45":112,"_113":89,"_114":28,"_115":51,"_52":116,"_117":118,"_119":103,"_120":112,"_121":61,"_122":17},[148],{"_97":98,"_99":100,"_101":43,"_102":103,"_104":105,"_106":107,"_108":43,"_109":-5,"_110":91,"_58":61,"_111":-5},[],"canDeleteTags","actionData","errors"]

devopstestlab/bdd-security

Tags for devopstestlab/bdd-security