Skip to content

Commit b5d23b8

Browse files
newlight77newlight77
committed
adding a handy example showing how to automate the pentest within the CI pipeline
This uses docker and docker-compose to run sandbox with sonarqube, zap tool and zap-sonar-plugin altogether in 3 steps : 1. run a sonarqube instance using docker with zap-sonar-plugin installed 2. generate a zapproxy.html report 3. publish the zapproxy.html report to sonarqube
1 parent 98b518b commit b5d23b8

13 files changed

Lines changed: 1925 additions & 0 deletions

‎README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,28 @@ sonar.zaproxy.htmlReportPath=${WORKSPACE}/zaproxy-htmlReport.html
4040
sonar.zaproxy.rulesFilePath=${WORKSPACE}/myrules.xml
4141
```
4242

43+
## Example of automation with a CI toolchain
44+
45+
```sh
46+
cd example
47+
48+
docker-compose up -d sonarqube
49+
sleep 120
50+
# wait 2 minute for sonarqbue to start
51+
52+
export PLUGIN_VERSION=2.2.0
53+
wget https://github.com/Coveros/zap-sonar-plugin/releases/download/sonar-zap-plugin-${PLUGIN_VERSION}/sonar-zap-plugin-${PLUGIN_VERSION}.jar -O ./plugin/sonar-zap-plugin-${PLUGIN_VERSION}.jar
54+
55+
export APP_URL_UNDER_TEST='your-url-under-test'
56+
docker-compose up owasp-zap
57+
docker-compose up sonar-scanner
58+
```
59+
60+
> If you wish to run the zap tool within the CI pipeline:
61+
> - you may refet to the [example](example)
62+
> - You need to have docker and docker-compose installed
63+
> - You may refer to [.gitlab-ci.yml](example/.gitlab-ci.yml) if you wish to run on Gitlab CI
64+
4365
## History
4466

4567
The ZAP SonarQube Plugin is derived from the

‎example/.gitignore‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
.scannerwork
2+
3+
### IntelliJ IDEA ###
4+
.idea
5+
*.iws
6+
*.iml
7+
*.ipr
8+
9+
### VS Code ###
10+
.vscode/
11+
12+
### Eclipse ###
13+
.classpath
14+
.factorypath
15+
.project
16+
.settings
17+
.metadata
18+
.springBeans
19+
.sts4-cache
20+
bin/
21+
tmp/
22+
*.tmp
23+
*.bak
24+
*.swp
25+
*.launch
26+
27+
### Vim ###
28+
[._]*.s[a-v][a-z]
29+
[._]*.sw[a-p]
30+
[._]s[a-v][a-z]
31+
[._]sw[a-p]
32+
Session.vim

‎example/.gitlab-ci.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
image: openjdk:13-slim
2+
3+
stages:
4+
- pentest
5+
6+
# please make sure to install the zap-sonar-plugin on sonarqube
7+
8+
owasp-zap:
9+
image: docker:19.03.12
10+
stage: pentest
11+
services:
12+
- name: docker:19.03.12-dind
13+
command: ["--insecure-registry=registry.gitlab.com"]
14+
variables:
15+
DOCKER_DRIVER: overlay2
16+
APP_URL_UNDER_TEST: https://oneprofile.io/auth
17+
PLUGIN_VERSION: 2.2.0
18+
before_script:
19+
- apk add --no-cache make git wget
20+
- apk add --no-cache docker-compose
21+
- docker info
22+
script:
23+
- wget https://github.com/Coveros/zap-sonar-plugin/releases/download/sonar-zap-plugin-${PLUGIN_VERSION}/sonar-zap-plugin-${PLUGIN_VERSION}.jar -O ./plugin/sonar-zap-plugin-${PLUGIN_VERSION}.jar
24+
- docker-compose up -d sonarqube
25+
- sleep 75
26+
- docker-compose up owasp-zap
27+
- docker-compose up sonar-scanner
28+
only:
29+
- master
30+
- develop
31+
32+
after_script:
33+
- echo "End CI"

‎example/Makefile‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#!make
2+
3+
# Makefile for Demo Auth Serve
4+
SHELL := /bin/sh
5+
6+
export APP_URL_UNDER_TEST ?= 'https://oneprofile.io/auth'
7+
export PLUGIN_VERSION ?= 2.2.0
8+
9+
$(info URL of the application under test = $(APP_URL_UNDER_TEST))
10+
11+
#build:
12+
# @docker-compose build sonarqube-build
13+
14+
sonarqube:
15+
@wget https://github.com/Coveros/zap-sonar-plugin/releases/download/sonar-zap-plugin-${PLUGIN_VERSION}/sonar-zap-plugin-${PLUGIN_VERSION}.jar -O ./plugin/sonar-zap-plugin-${PLUGIN_VERSION}.jar
16+
@docker-compose up -d sonarqube
17+
18+
zap:
19+
@docker-compose up owasp-zap
20+
21+
sonar-scan:
22+
@docker-compose up sonar-scanner
23+
24+
zap-scan: zap sonar-scan
25+
26+
run:
27+
@wget https://github.com/Coveros/zap-sonar-plugin/releases/download/sonar-zap-plugin-${PLUGIN_VERSION}/sonar-zap-plugin-${PLUGIN_VERSION}.jar -O ./plugin/sonar-zap-plugin-${PLUGIN_VERSION}.jar
28+
@docker-compose up -d sonarqube
29+
@sleep 75
30+
@docker-compose up owasp-zap
31+
@docker-compose up sonar-scanner
32+
33+
down:
34+
@docker-compose down

‎example/README.md‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# zap-sonar-plugin-example
2+
3+
## Prerequisites
4+
5+
- [Git](https://git-scm.com/downloads)
6+
- [Make](https://www.gnu.org/software/make/)
7+
- [Docker](https://docs.docker.com/install/) and [docker-compose](https://docs.docker.com/compose/install/)
8+
9+
## Scan the vulnerabilitis with owasp-zap tool
10+
11+
```sh
12+
export PLUGIN_VERSION=2.2.0
13+
export APP_URL_UNDER_TEST='your-url-under-test'
14+
make run
15+
```
16+
17+
or
18+
19+
```sh
20+
docker-compose up -d sonarqube
21+
sleep 120
22+
# wait 2 minute for sonarqbue to start
23+
24+
export PLUGIN_VERSION=2.2.0
25+
wget https://github.com/Coveros/zap-sonar-plugin/releases/download/sonar-zap-plugin-${PLUGIN_VERSION}/sonar-zap-plugin-${PLUGIN_VERSION}.jar -O ./plugin/sonar-zap-plugin-${PLUGIN_VERSION}.jar
26+
27+
export APP_URL_UNDER_TEST='your-url-under-test'
28+
docker-compose up owasp-zap
29+
docker-compose up sonar-scanner
30+
```
31+
32+
Then go to [sonarqube](http://localhost:9000)
33+
34+
Please have a look on `.gitlab-ci.yml` if you wish to run the scan wihtin the Gitlab CI pipeline.
35+
36+
## Vulnerabilities Scan
37+
38+
The Open Web Application Security Project (OWASP) team recommends many [tools](https://www.owasp.org/index.php/Appendix_A:_Testing_Tools) to address security matters, allowing to scan the vulnerabilities of Web Applications.One of the most popular is OWASP `Zed Attack Proxy` (**ZAP**).
39+
40+
## OWASP Zap Tool
41+
42+
The Open Web Application Security Project (OWASP) provides a security tool, called `Zed Attack Proxy` (**ZAP**) to scan the vulnerabilities.
43+
44+
![Alt Text](assets/owasp-zap-2.8.0.png)
45+
46+
You may download the standalone application [here](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) or use it with CLI.Using the CLI is interesting as in the software industry, we may want to automate to this inside the Continuous Integration (**CI**) toolchain.
47+
48+
OWASP ZAP is one of the most popular security tools and is actively maintained. It comes with a UI and it allows to launch an automated scan against a URL of a web application. It then generate a report.
49+
50+
![Alt Text](assets/zaproxy-report.html)
51+
52+
The generated report is then published to Sonarqube by this hereby plugin. As a result, all metrics related to a software are gathered at one place.
53+
54+
## Quality Metrics
55+
56+
Once this is done, we can see the [vulnerabilities](http://127.0.0.1:9000) metrics on SonarQube.
57+
58+
![Alt Text](assets/sonarqube-vulnerabilities.png)

‎example/assets/owasp-zap-2.8.0.png‎

400 KB
Loading

‎example/assets/sonarqube-vulnerabilities.png‎

537 KB
Loading

0 commit comments

Comments
 (0)