strike1/execute-vm-test

StrikeOne VM Test

Documentation

Overview

A test can be performed externally by authenticating a StrikeOne Admin account from your preferred CI/CD application.

Remote Test Execution

In order to execute a test, you will need to have an authorization token. Users can generate API Tokens from the Integrations menu in the StrikeOne settings.

Install instructions

docker pull strike1/execute-vm-test:latest

Usage instructions

docker run --rm -it strikeone/execute_vm_test python execute_test.py

Flags

-ut, --usertoken  User token from StrikeOne
-tn, --testname Test name
-an, --assetname Asset name (Must be unique)
-tt, --typetest Type of test (sast/dast)
-t,  --tool Tool to execute scan
-d, --domain Domain to DAST test and assign vulnerabilities (Must be unique by asset)

Optional flags to SAST analysis

-url, --urlproject Url of repo
-pn, --projectname Name of repo
-pb, --projectbranch Name of branch to analyze
-qg, --qualitygate Return quality gate from SonarQube Instance ? (True)
-surl, --sonarurl Url of SonarQube Instance
-stoken, --sonartoken SonarQube User Token
-se, --sonarexclusions SonarQube Exclusions

TIPs

• When flag --typetest = sast, you must enter --urlproject --projectname --projectbranch
• When flag --qualitygate = True, you must enter --sonarurl --sonartoken
• If the asset does not exist, it will be created automatically
• If the domain does not exist, it will be created automatically

Tools availables

SAST

• GitLeaks (gitleaks), secrets scan
• Horusec (horusec), sast scan
• OWASP Dependency-Check (dep_check), dependencies/libraries scan
• SonarQube (sonarqube), sast scan

DAST

• Nuclei (nuclei)
• OWASP ZAP (owasp_zap)
• OpenVAS (openvas) note: OpenVAS can take more than hour for test

Example SAST scan GitHub Actions

name: CI
on:
  push:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Pull docker StrikeOne
        run: docker pull strike1/execute-vm-test:latest

      - name: Execute Sonar Test
        run: |
          export REPO_NAME=${GITHUB_REPOSITORY#*/}
          echo "$REPO_NAME"
          export SONAR_TEST=$(docker run --rm strike1/execute-vm-test:latest python execute_test.py -ut ${{secrets.SO_TOKEN}} -tn test_name -an "$REPO_NAME" -tt sast -t sonarqube -d https://google.com -url [***]{{secrets.GH_TOKEN}}@github.com/user/repo.git -pn "$REPO_NAME" -pb main)
          echo "$SONAR_TEST"
          if echo "$SONAR_TEST" | grep -iq "Error"; then
            echo "[SH] Error al ejecutar test..."
            exit 1
          fi

Example DAST scan GitHub Actions

name: CI
on:
  push:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Pull docker StrikeOne
        run: docker pull strike1/execute-vm-test:latest

      - name: Execute OWASP ZAP Test
        run: |
          export REPO_NAME=${GITHUB_REPOSITORY#*/}
          echo "$REPO_NAME"
          export OWASP_TEST=$(docker run --rm strike1/execute-vm-test:latest python execute_test.py -ut ${{secrets.SO_TOKEN}} -tn test_name -an "$REPO_NAME" -tt dast -t owasp_zap -d [***]
          echo "$OWASP_TEST"
          if echo "$OWASP_TEST" | grep -iq "Error"; then
            echo "[SH] Error al ejecutar test..."
            exit 1
          fi