Skip to content

Commit a48b70f

Browse files
binarymistbinarymist
committedJul 4, 2023
feat: Merge schemas and add API
1 parent e687817 commit a48b70f

6 files changed

+85
-27
lines changed
 

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@ jobs/*
44
!jobs/simple-BrowserApp-job-example
55
!jobs/simple-BrowserApp-job-fast-example
66
!jobs/advanced-BrowserApp-job-example
7+
!jobs/job_crAPI-example
78

‎jobs/README.md

+5-8
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,10 @@ Documentation around the _Job_ file structure can be found at https://docs.guard
22

33
Examples of _Job_ files can be found at https://github.com/guardrailsio/runtime-resources/tree/main/jobs
44

5-
* advanced-BrowserApp-job-example: This _Job_ file targets the [NodeGoat](https://github.com/OWASP/NodeGoat) SUT, which we host using [purpleteam-iac-sut](https://github.com/purpleteam-labs/purpleteam-iac-sut). You can use this _Job_ file and just update the `sutHost` to point to your hosted copy of NodeGoat as well as the `username` and `passwordBase64` properties
5+
* **advanced-BrowserApp-job-example**: This _Job_ file targets the [NodeGoat](https://github.com/OWASP/NodeGoat) SUT, which we host using [purpleteam-iac-sut](https://github.com/purpleteam-labs/purpleteam-iac-sut). You can use this _Job_ file and just update the `sutHost` to point to your hosted copy of NodeGoat as well as the `username` and `passwordBase64` properties
6+
* **job_crAPI-example**: This _Job_ file targets the [crAPI](https://github.com/OWASP/crAPI) SUT, which our devops team hosts for us. If using this _Job_ file, you will need to provide a valid `sutHost` property value. The `username` and `passwordBase64` properties will need updating with the values you entered when you created your user in a hosted copy of the crAPI project. The `openApi.importFileContentBase64` value will need to be updated
7+
* **simple-BrowserApp-job-example**: This _Job_ file is good for most browser applications that don't require authentication. If using this _Job_ file, you will need to provide a valid `sutHost` property value. As it is, it will inform the _Application Testing Engine_ to scan the specified host from the root. If you want to be more specific, you can add routes to be scanned
8+
* **simple-BrowserApp-job-fast-example**: This _Job_ file extends simple-BrowserApp-job-example by adding a single route, this will inform the _Application Testing Engine_ to only scan the specified route of the specified host. You will need to provide a valid `sutHost` property value, and a valid `route.id` property value. By using this _Job_, the [_Test Run_](https://docs.guardrails.io/docs/glossary#test-run) should be faster because it is not scanning from the root
69

7-
If you are using a forwarding proxy, between the engine and your SUT, configure the `forwardingProxy` object properties with valid values. If you are not using a fowarding proxy, just remove the `forwardingProxy` object
8-
* simple-BrowserApp-job-example: This _Job_ file is good for most browser applications that don't require authentication. If using this _Job_ file, you will need to provide a valid `sutHost` property value. As it is, it will inform the _Application Testing Engine_ to scan the specified host from the root. If you want to be more specific, you can add routes to be scanned.
9-
10-
If you are using a forwarding proxy, between the engine and your SUT, configure the `forwardingProxy` object properties with valid values. If you are not using a fowarding proxy, just remove the `forwardingProxy` object
11-
* simple-BrowserApp-job-fast-example: This _Job_ file extends simple-BrowserApp-job-example by adding a single route, this will inform the _Application Testing Engine_ to only scan the specified route of the specified host. You will need to provide a valid `sutHost` property value, and a valid `route.id` property value. By using this _Job_, the [_Test Run_](https://docs.guardrails.io/docs/glossary#test-run) should be faster because it is not scanning from the root.
12-
13-
If you are using a forwarding proxy, between the engine and your SUT, configure the `forwardingProxy` object properties with valid values. If you are not using a fowarding proxy, just remove the `forwardingProxy` object
10+
If you are using a forwarding proxy, between the engine and your SUT, configure the `forwardingProxy` object properties with valid values. If you are not using a fowarding proxy, just remove the `forwardingProxy` object
1411

‎jobs/advanced-BrowserApp-job-example

+4-6
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"data": {
3-
"type": "BrowserApp",
3+
"type": "Job",
44
"attributes": {
5-
"version": "1.0.0",
5+
"version": "2.0.0",
66
"sutAuthentication": {
77
"sitesTreeSutAuthenticationPopulationStrategy": "FormStandard",
88
"emissaryAuthenticationStrategy": "FormStandard",
@@ -44,8 +44,7 @@
4444
"type": "tlsScanner",
4545
"id": "NA",
4646
"attributes": {
47-
"tlsScannerSeverity": "LOW",
48-
"alertThreshold": 3
47+
"tlsScannerSeverity": "LOW"
4948
}
5049
},
5150
{
@@ -61,8 +60,7 @@
6160
"username": "<your-user>",
6261
"passwordBase64": "<your-base64-encoded-password>",
6362
"aScannerAttackStrength": "HIGH",
64-
"aScannerAlertThreshold": "LOW",
65-
"alertThreshold": 12
63+
"aScannerAlertThreshold": "LOW"
6664
},
6765
"relationships": {
6866
"data": [{

‎jobs/job_crAPI-example

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"data": {
3+
"type": "Job",
4+
"attributes": {
5+
"version": "2.0.0",
6+
"sutAuthentication": {
7+
"emissaryAuthenticationStrategy": "MaintainJwtJsonBasedBespokeCrApi",
8+
"route": "/identity/api/auth/login",
9+
"usernameFieldLocater": "email",
10+
"passwordFieldLocater": "password"
11+
},
12+
"sutHost": "<targetdomain.com>",
13+
"sutPort": 443,
14+
"sutProtocol": "https",
15+
"loggedOutIndicator": "\\b(Unauthorized|Forbidden|Invalid Token)\\b",
16+
"forwardingProxy": {
17+
"protocol": "[http|https]",
18+
"authorizationBase64": "<base64-encoded-username:password>",
19+
"hostname": "<proxy-hostname>",
20+
"port": <proxy-port>
21+
}
22+
},
23+
"relationships": {
24+
"data": [{
25+
"type": "tlsScanner",
26+
"id": "NA"
27+
},
28+
{
29+
"type": "appScanner",
30+
"id": "noUser1"
31+
}]
32+
}
33+
},
34+
"included": [
35+
{
36+
"type": "tlsScanner",
37+
"id": "NA",
38+
"attributes": {
39+
"tlsScannerSeverity": "LOW"
40+
}
41+
},
42+
{
43+
"type": "appScanner",
44+
"id": "noUser1",
45+
"attributes": {
46+
"sitesTreePopulationStrategy": "OpenApi",
47+
"spiderStrategy": "Standard",
48+
"scannersStrategy": "ApiStandard",
49+
"scanningStrategy": "ApiStandard",
50+
"postScanningStrategy": "ApiStandard",
51+
"reportingStrategy": "Standard",
52+
"username": "<your-user>",
53+
"passwordBase64": "<your-base64-encoded-password>",
54+
"openApi": {
55+
"importFileContentBase64": "<your-base64-encoded-openapi-spec>"
56+
},
57+
"aScannerAttackStrength": "MEDIUM",
58+
"aScannerAlertThreshold": "LOW",
59+
"excludedRoutes": [
60+
"^.*change-email.*$",
61+
"^.*reset-password.*$"
62+
]
63+
}
64+
}
65+
]
66+
}

‎jobs/simple-BrowserApp-job-example

+4-6
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"data": {
3-
"type": "BrowserApp",
3+
"type": "Job",
44
"attributes": {
5-
"version": "1.0.0",
5+
"version": "2.0.0",
66
"sutAuthentication": {
77
"sitesTreeSutAuthenticationPopulationStrategy": "NoAuthentication",
88
"emissaryAuthenticationStrategy": "NoAuthentication"
@@ -34,8 +34,7 @@
3434
"type": "tlsScanner",
3535
"id": "NA",
3636
"attributes": {
37-
"tlsScannerSeverity": "LOW",
38-
"alertThreshold": 3
37+
"tlsScannerSeverity": "LOW"
3938
}
4039
},
4140
{
@@ -49,8 +48,7 @@
4948
"postScanningStrategy": "BrowserAppStandard",
5049
"reportingStrategy": "Standard",
5150
"aScannerAttackStrength": "HIGH",
52-
"aScannerAlertThreshold": "LOW",
53-
"alertThreshold": 12
51+
"aScannerAlertThreshold": "LOW"
5452
},
5553
"relationships": {
5654
"data": []

‎jobs/simple-BrowserApp-job-fast-example

+5-7
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"data": {
3-
"type": "BrowserApp",
3+
"type": "Job",
44
"attributes": {
5-
"version": "1.0.0",
5+
"version": "2.0.0",
66
"sutAuthentication": {
77
"sitesTreeSutAuthenticationPopulationStrategy": "NoAuthentication",
88
"emissaryAuthenticationStrategy": "NoAuthentication"
@@ -13,7 +13,7 @@
1313
"browser": "chrome",
1414
"forwardingProxy": {
1515
"protocol": "[http|https]",
16-
"authorizationBase64": "<base64-encoded-username-password>",
16+
"authorizationBase64": "<base64-encoded-username:password>",
1717
"hostname": "<proxy-hostname>",
1818
"port": <proxy-port>
1919
}
@@ -34,8 +34,7 @@
3434
"type": "tlsScanner",
3535
"id": "NA",
3636
"attributes": {
37-
"tlsScannerSeverity": "LOW",
38-
"alertThreshold": 3
37+
"tlsScannerSeverity": "LOW"
3938
}
4039
},
4140
{
@@ -49,8 +48,7 @@
4948
"postScanningStrategy": "BrowserAppStandard",
5049
"reportingStrategy": "Standard",
5150
"aScannerAttackStrength": "HIGH",
52-
"aScannerAlertThreshold": "LOW",
53-
"alertThreshold": 12
51+
"aScannerAlertThreshold": "LOW"
5452
},
5553
"relationships": {
5654
"data": [{"type": "route", "id": "</my-route>"}]

0 commit comments

Comments
 (0)
Failed to load comments.