VM Test V2

Overview

A test can be performed externally by authenticating a StrikeOne Admin account from your preferred CI/CD application.

Remote Test Execution

In order to execute a test, you will need to have an authorization token. Users can generate API Tokens from the Integrations menu in the StrikeOne settings.

Install instructions

    docker pull strike1/execute-vm-test:latest

Usage instructions

    docker run --rm -it strikeone/execute_vm_test python execute_test.py

Flags

    -ut, --usertoken  User token from StrikeOne
    -tn, --testname Test name
    -an, --assetname Asset name
    -tt, --typetest Type of test (sast/dast)
    -t,  --tool Tool to execute scan
    -d, --domain Domain to DAST test and assign vulnerabilities

Optional flags to SAST analysis

    -url, --urlproject Url of repo
    -pn, --projectname Name of repo
    -pb, --projectbranch Name of branch to analyze
    -qg, --qualitygate Return quality gate from SonarQube Instance ? (True)
    -surl, --sonarurl Url of SonarQube Instance
    -stoken, --sonartoken SonarQube User Token
    -se, --sonarexclusions SonarQube Exclusions

TIPs

• When flag --typetest = sast, you must enter --urlproject --projectname --projectbranch
• When flag --qualitygate = True, you must enter --sonarurl --sonartoken
• If the asset does not exist, it will be created automatically
• If the domain does not exist, it will be created automatically
• If you want to exclude more than one file and/or directory, you must separate them with a comma. (Ex: src/,tests/)

Tools available

SAST

• GitLeaks (gitleaks), secrets scan
• Horusec (horusec), sast scan
• OWASP Dependency-Check (dep_check), dependencies/libraries scan
• SonarQube (sonarqube), sast scan

DAST

• Nuclei (nuclei)
• OWASP ZAP (owasp_zap)
• OpenVAS (openvas) note: OpenVAS can take more than hour for test

Example SAST scan GitHub Actions

    name: CI
    on:
      push:
        branches: [ "main" ]

    jobs:
      build:
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v4

          - name: Pull docker StrikeOne
            run: docker pull strike1/execute-vm-test:latest

          - name: Execute Sonar Test
            run: |
              export REPO_NAME=${GITHUB_REPOSITORY#*/}
              echo "$REPO_NAME"
              export SONAR_TEST=$(docker run --rm strike1/execute-vm-test:latest python execute_test.py -ut ${{secrets.SO_TOKEN}} -tn test_name -an "$REPO_NAME" -tt sast -t sonarqube -d https://google.com -url https://${{secrets.GH_TOKEN}}@github.com/user/repo.git -pn "$REPO_NAME" -pb main)
              echo "$SONAR_TEST"
              if echo "$SONAR_TEST" | grep -iq "Error"; then
                echo "[SH] Error al ejecutar test..."
                exit 1
              fi

Example DAST scan GitHub Actions

    name: CI
    on:
      push:
        branches: [ "main" ]

    jobs:
      build:
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v4

          - name: Pull docker StrikeOne
            run: docker pull strike1/execute-vm-test:latest

          - name: Execute OWASP ZAP Test
            run: |
              export REPO_NAME=${GITHUB_REPOSITORY#*/}
              echo "$REPO_NAME"
              export OWASP_TEST=$(docker run --rm strike1/execute-vm-test:latest python execute_test.py -ut ${{secrets.SO_TOKEN}} -tn test_name -an "$REPO_NAME" -tt dast -t owasp_zap -d https://google.com)
              echo "$OWASP_TEST"
              if echo "$OWASP_TEST" | grep -iq "Error"; then
                echo "[SH] Error al ejecutar test..."
                exit 1
              fi

Example SAST scan with Azure Pipelines

# Pipeline name
name: CI-$(Build.BuildId)

# Triggers
trigger:
  branches:
    include:
      - main

# Specify Agent
pool:
  vmImage: 'ubuntu-latest'

# Variables
variables:
  REPO_NAME: $(Build.Repository.Name) # Obtain name of repository

# Steps
steps:
  # Pull docker image
  - script: |
      echo "Pulling Docker image..."
      docker pull strike1/execute-vm-test:latest
    displayName: 'Pull Docker StrikeOne'

  # Executes sonar test
  - script: |
      echo "Executing Sonar Test..."
      export SONAR_TEST=$(docker run --rm strike1/execute-vm-test:latest python execute_test.py -ut $(SO_TOKEN) -tn test_name -an "$(REPO_NAME)" -tt sast -t sonarqube -d https://google.com -url https://$(GH_TOKEN)@github.com/user/repo.git -pn "$(REPO_NAME)" -pb main)
      echo "$SONAR_TEST"
      if echo "$SONAR_TEST" | grep -iq "Error"; then
        echo "[SH] Error al ejecutar test..."
        exit 1
      fi
    displayName: 'Execute Sonar Test'

Example DAST scan with Azure Pipelines

# Pipeline Name
name: CI-$(Build.BuildId)

# Triggers
trigger:
  branches:
    include:
      - main

# Specify agent
pool:
  vmImage: 'ubuntu-latest'

# Variables
variables:
  REPO_NAME: $(Build.Repository.Name) # Repository name

# Steps
steps:
  # Pull docker image
  - script: |
      echo "Pulling Docker image..."
      docker pull strike1/execute-vm-test:latest
    displayName: 'Pull Docker StrikeOne'

  # Executes OWASP ZAP test
  - script: |
      echo "Executing OWASP ZAP Test..."
      export OWASP_TEST=$(docker run --rm strike1/execute-vm-test:latest python execute_test.py -ut $(SO_TOKEN) -tn test_name -an "$(REPO_NAME)" -tt dast -t owasp_zap -d https://google.com)
      echo "$OWASP_TEST"
      if echo "$OWASP_TEST" | grep -iq "Error"; then
        echo "[SH] Error al ejecutar test..."
        exit 1
      fi
    displayName: 'Execute OWASP ZAP Test'
    env:
      SO_TOKEN: $(SO_TOKEN) # Secret: StrikeOne Token