[{"_1":2,"_161":-5,"_162":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_140":141},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_128":-5,"_129":11,"_130":21,"_131":11,"_132":11,"_133":-5,"_134":11,"_135":-5,"_136":137,"_138":91,"_139":-7},"canonicalUrl","https://hub.docker.com/r/devopstestlab/bdd-security/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","devopstestlab","reponame","bdd-security","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2019-07-08T11:43:42.10173Z","description","","is_private","last_updated","2021-12-29T09:50:13.149869Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",714,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","The framework is essentially a set of Cucumber-JVM features that are pre-wired with :\n- Selenium/WebDriver,\n- OWASP ZAP, https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project\n - Some of the built in features include: Intercepting proxy server, Traditional and AJAX Web crawlers, Automated scanner, Passive scanner, Forced browsing, Fuzzer, WebSocket support, Scripting languages, and Plug-n-Hack support. It has a plugin-based architecture and an online ‘marketplace’ which allows new or updated features to be added.\n- SSLyze https://github.com/nabla-c0d3/sslyze\n\t- Fast and powerful SSL/TLS server scanning library\n- Tennable's Nessus scanner. http://www.tenable.com/products/nessus-vulnerability-scanner\n\n## Usage\n\n```\ncd example\n```\n\nRun a webserver for a demo :\n\n```\njava -jar ropeytasks.jar\n```\n\nExecute a specific feature (\" '\"authentication\") :\n\n```\n./gradlew -Dcucumber.options=\"--tags @authentication --tags ~@skip\"\n```\n\nThe test results are stored in : `./build/reports/cucumber/pretty/feature-overview.html`\n\nTo execute all the features including ZAP scanning:\n\n```\n./gradlew\n```\n\nTo select a browser (\"Chrome\" for example), choose the Chrome driver binary in the config.xml file :\n\n```\nChrome\n```\n\nTo scan with OWASP ZAP :\n- configure the application to login and navigate through Selenium steps in the Java class defined in the 'class' tag in config.xml :\n - `net.continuumsecurity.MyComplexApp`\n - This class should extend the WebApplication class and implement the Navigable interface :\n\n```\n public class MyComplexApp extends WebApplication implements INavigable {\n\n public void navigate() {\n driver.get(Config.getInstance().getBaseUrl() + \"user/login\");\n UserPassCredentials creds = new UserPassCredentials(Config.getInstance().getDefaultCredentials());\n driver.findElement(By.id(\"username\")).clear();\n driver.findElement(By.id(\"username\")).sendKeys(creds.getUsername());\n driver.findElement(By.id(\"password\")).clear();\n driver.findElement(By.id(\"password\")).sendKeys(creds.getPassword());\n driver.findElement(By.name(\"_action_login\")).click();\n \n //Click on the \"tasks\" link\n findAndWaitForElement(By.linkText(\"Tasks\")).click();\n \n //Enter a search query\n driver.findElement(By.id(\"q\")).clear();\n driver.findElement(By.id(\"q\")).sendKeys(\"test\");\n driver.findElement(By.id(\"search\")).click();\n }\n```\n\n - to read values from the config file, use : Config.getInstance()\n - Configure the following values :\n\n```\n \thttp://www.example.com/\n \tbob\n \tpassword\n```\n\nTo launch the ZAP scanning tests:\n\n```\n./gradlew -Dcucumber.options=\"--tags @app_scan --tags ~@skip\" test\n```\n\nThe `./src/test/resources/features/app_scan.feature` file will be launched.\n\nTo test SSL :\n- Install the SSLyze package\n- edit the config.xml file :\n\n```\n \n /opt/sslyze/sslyze_cli.py\n \n \n```\n\n- run the SSL tests:\n\n```\n./gradlew -Dcucumber.options=\"--tags @ssl\" test\n```\n\nTo run a specific feature, specify its tag:\n\n```\n./gradle -Dcucumber.options=\"--tags @authentication\"\n```\n\nTo skip some tests, spefiy them with the proprty \"tags\" :\n\n```\n./gradle -Dcucumber.options=\"--tags @authentication,@http_headers --tags ~@skip\"\n```\n\nThe results are :\n- HTML Cucumber resulsts : build/reports/cucumber/pretty/feature-overview.html\n- JSON Cucumber results : build/reports/cucumber/all_tests.json\n- JUnit results : build/reports/junit/all_tests.xml\n\nThe JUnit resulsts can be integrated in the CI pipeline.\n\nIntegration in Jenkins :\n- Create a Gradle build task\n- set Cucumber options in the 'Tasks' section : -Dcucumber.options=\"--tags @authentication,@http_headers --tags ~@skip\"\n- Add a Post-Build Action to publish JUnit test results\n- set the Test report XMLs to: build/reports/junit/*.xml\n\nBut you can prefer to use a plugin :\n- Cucumber-JVM reports : https://github.com/jenkinsci/cucumber-reports-plugin\n- Bootstrap multi-test results report : https://wiki.jenkins-ci.org/display/JENKINS/Bootstraped+Multi+Test+Results+Report\n\nIn this case, add a Post-Build Action : set the JSON reports path to: build/reports\n\nWith Docker :\n\n```\nBuild : docker build --no-cache -t bdd-security .\n```\n\n- Run the webserver for demo :\n\n```\njava -jar ropeytasks.jar\n```\n\n(mais ne fonctionne que sur localhost)\n\n- Copy the .attack files in the `../features` directory.\n- Set the Webserver IP address in the docker-compose.yml file.\n- Run :\n\n```\ndocker-compose up bdd-security\n```\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",2731649649,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":117,"_118":94,"_119":33,"_120":56,"_57":121,"_122":123,"_124":108,"_125":117,"_126":66,"_127":21},"content_type","creator",6923745,"full_size",760177651,"id",61407717,"images",[101],{"_102":103,"_104":105,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":96,"_63":66,"_116":-5},"architecture","amd64","digest","sha256:93887d8295653ba937973278890ea28c14533194671c0a3ac31b9649397f1f0e","features","last_pulled","2026-10-17T04:19:05.997306342Z","last_pushed","2021-12-29T09:50:13Z","os","linux","os_features","os_version","size","variant","2021-12-29T09:50:12.828222Z","last_updater","last_updater_username","media_type","latest","repository",7372983,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":142,"_149":150,"_136":159,"_160":11},{"_40":143,"_42":144,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":145,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":146,"_79":11,"_80":148,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":147},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_151":64,"_152":-5,"_153":-5,"_154":155},"count","next","previous","results",[156],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":157,"_50":117,"_118":94,"_119":33,"_120":56,"_57":121,"_122":123,"_124":108,"_125":117,"_126":66,"_127":21},[158],{"_102":103,"_104":105,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":96,"_63":66,"_116":-5},[],"canDeleteTags","actionData","errors"]

devopstestlab/bdd-security

Tags for devopstestlab/bdd-security