Skip to content

Commit d79ba9b

Browse files
binarymistbinarymist
committedApr 27, 2023
feat(jobs-strategies):
1 parent 8ef0fff commit d79ba9b

35 files changed

+1913
-0
lines changed
 

‎.gitignore

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
jobs/*
2+
3+
!jobs/README.md
4+
!jobs/simple-BrowserApp-job-example
5+
!jobs/advanced-BrowserApp-job-example
6+

‎jobs/README.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
Documentation around the _Job_ file structure can be found at https://docs.guardrails.io/docs/category/job-file
2+
3+
Examples of _Job_ files can be found at https://github.com/guardrailsio/runtime-resources/tree/main/jobs
4+

‎jobs/advanced-BrowserApp-job-example

+129
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
{
2+
"data": {
3+
"type": "BrowserApp",
4+
"attributes": {
5+
"version": "0.0.1",
6+
"sutAuthentication": {
7+
"sitesTreeSutAuthenticationPopulationStrategy": "FormStandard",
8+
"emissaryAuthenticationStrategy": "FormStandard",
9+
"route": "/login",
10+
"usernameFieldLocater": "userName",
11+
"passwordFieldLocater": "password",
12+
"submit": "btn btn-danger",
13+
"expectedPageSourceSuccess": "Log Out"
14+
},
15+
"sutHost": "nodegoat.sut.purpleteam-labs.com",
16+
"sutPort": 443,
17+
"sutProtocol": "https",
18+
"browser": "chrome",
19+
"loggedInIndicator": "<p>Found. Redirecting to <a href=\"\/dashboard\">\/dashboard<\/a><\/p>"
20+
},
21+
"relationships": {
22+
"data": [{
23+
"type": "tlsScanner",
24+
"id": "NA"
25+
},
26+
{
27+
"type": "appScanner",
28+
"id": "lowPrivUser"
29+
},
30+
{
31+
"type": "appScanner",
32+
"id": "adminUser"
33+
}]
34+
}
35+
},
36+
"included": [
37+
{
38+
"type": "tlsScanner",
39+
"id": "NA",
40+
"attributes": {
41+
"tlsScannerSeverity": "LOW",
42+
"alertThreshold": 3
43+
}
44+
},
45+
{
46+
"type": "appScanner",
47+
"id": "lowPrivUser",
48+
"attributes": {
49+
"sitesTreePopulationStrategy": "WebDriverStandard",
50+
"spiderStrategy": "Standard",
51+
"scannersStrategy": "BrowserAppStandard",
52+
"scanningStrategy": "BrowserAppStandard",
53+
"postScanningStrategy": "BrowserAppStandard",
54+
"reportingStrategy": "Standard",
55+
"reports": {
56+
"templateThemes": [{
57+
"name": "traditionalJson"
58+
}]
59+
},
60+
"username": "[your-user]",
61+
"password": "[your-password]",
62+
"aScannerAttackStrength": "HIGH",
63+
"aScannerAlertThreshold": "LOW",
64+
"alertThreshold": 12
65+
},
66+
"relationships": {
67+
"data": [{
68+
"type": "route",
69+
"id": "/profile"
70+
}]
71+
}
72+
},
73+
{
74+
"type": "appScanner",
75+
"id": "adminUser",
76+
"attributes": {
77+
"sitesTreePopulationStrategy": "WebDriverStandard",
78+
"spiderStrategy": "Standard",
79+
"scannersStrategy": "BrowserAppStandard",
80+
"scanningStrategy": "BrowserAppStandard",
81+
"postScanningStrategy": "BrowserAppStandard",
82+
"reportingStrategy": "Standard",
83+
"username": "[admin-user]",
84+
"password": "[admin-password]"
85+
},
86+
"relationships": {
87+
"data": [{
88+
"type": "route",
89+
"id": "/memos"
90+
},
91+
{
92+
"type": "route",
93+
"id": "/profile"
94+
}]
95+
}
96+
},
97+
{
98+
"type": "route",
99+
"id": "/profile",
100+
"attributes": {
101+
"attackFields": [
102+
{"name": "firstName", "value": "PurpleJohn", "visible": true},
103+
{"name": "lastName", "value": "PurpleDoe", "visible": true},
104+
{"name": "ssn", "value": "PurpleSSN", "visible": true},
105+
{"name": "dob", "value": "12235678", "visible": true},
106+
{"name": "bankAcc", "value": "PurpleBankAcc", "visible": true},
107+
{"name": "bankRouting", "value": "0198212#", "visible": true},
108+
{"name": "address", "value": "PurpleAddress", "visible": true},
109+
{"name": "website", "value": "https://purpleteam-labs.com", "visible": true},
110+
{"name": "_csrf", "value": ""},
111+
{"name": "submit", "value": ""}
112+
],
113+
"method": "POST",
114+
"submit": "submit"
115+
}
116+
},
117+
{
118+
"type": "route",
119+
"id": "/memos",
120+
"attributes": {
121+
"attackFields": [
122+
{"name": "memo", "value": "PurpleMemo", "visible": true}
123+
],
124+
"method": "POST",
125+
"submit": "btn btn-primary"
126+
}
127+
}
128+
]
129+
}

‎jobs/simple-BrowserApp-job-example

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"data": {
3+
"type": "BrowserApp",
4+
"attributes": {
5+
"version": "0.0.1",
6+
"sutAuthentication": {
7+
"sitesTreeSutAuthenticationPopulationStrategy": "NoAuthentication",
8+
"emissaryAuthenticationStrategy": "NoAuthentication"
9+
},
10+
"sutHost": "[targetdomain.com]",
11+
"sutPort": 443,
12+
"sutProtocol": "https",
13+
"browser": "chrome"
14+
},
15+
"relationships": {
16+
"data": [{
17+
"type": "tlsScanner",
18+
"id": "NA"
19+
},
20+
{
21+
"type": "appScanner",
22+
"id": "NA"
23+
}]
24+
}
25+
},
26+
"included": [
27+
{
28+
"type": "tlsScanner",
29+
"id": "NA",
30+
"attributes": {
31+
"tlsScannerSeverity": "LOW",
32+
"alertThreshold": 3
33+
}
34+
},
35+
{
36+
"type": "appScanner",
37+
"id": "NA",
38+
"attributes": {
39+
"sitesTreePopulationStrategy": "WebDriverStandard",
40+
"spiderStrategy": "Standard",
41+
"scannersStrategy": "BrowserAppStandard",
42+
"scanningStrategy": "BrowserAppStandard",
43+
"postScanningStrategy": "BrowserAppStandard",
44+
"reportingStrategy": "Standard",
45+
"reports": {
46+
"templateThemes": [{
47+
"name": "traditionalJson"
48+
}]
49+
},
50+
"aScannerAttackStrength": "HIGH",
51+
"aScannerAlertThreshold": "LOW",
52+
"alertThreshold": 12
53+
},
54+
"relationships": {
55+
"data": []
56+
}
57+
}
58+
]
59+
}

‎sUtAndEmissaryStrategies/1_sitesTreeSutAuthenticationPopulation/formStandard.js

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Copyright (C) 2017-2022 BinaryMist Limited. All rights reserved.
2+
3+
// Use of this software is governed by the Business Source License
4+
// included in the file /licenses/bsl.md
5+
6+
// As of the Change Date specified in that file, in accordance with
7+
// the Business Source License, use of this software will be governed
8+
// by the Apache License, Version 2.0
9+
10+
import SitesTreeSutAuthenticationPopulation from './strategy.js';
11+
12+
class FormStandard extends SitesTreeSutAuthenticationPopulation {
13+
#fileName = 'formStandard';
14+
15+
constructor({ log, baseUrl, browser, sutPropertiesSubSet }) {
16+
super({ log, baseUrl, browser, sutPropertiesSubSet });
17+
}
18+
19+
async authenticate() {
20+
const methodName = 'authenticate';
21+
const { findElementThenClick, findElementThenSendKeys, checkAndNotifyBuildUserIfAnyKnownBrowserErrors } = this.browser;
22+
const {
23+
authentication: { route: loginRoute, usernameFieldLocater, passwordFieldLocater, submit, expectedPageSourceSuccess },
24+
testSession: { attributes: { username, password } }
25+
} = this.sutPropertiesSubSet;
26+
27+
this.log.info(`The ${methodName}() method of the ${super.constructor.name} strategy "${this.constructor.name}" has been invoked.`, { tags: [this.#fileName, methodName] });
28+
29+
const webDriver = this.browser.getWebDriver();
30+
await webDriver.getWindowHandle();
31+
await webDriver.get(`${this.baseUrl}${loginRoute}`);
32+
await checkAndNotifyBuildUserIfAnyKnownBrowserErrors();
33+
await findElementThenSendKeys({ name: usernameFieldLocater, value: username, visible: true });
34+
await findElementThenSendKeys({ name: passwordFieldLocater, value: password, visible: true });
35+
await findElementThenClick(submit, expectedPageSourceSuccess);
36+
}
37+
}
38+
39+
export default FormStandard;

‎sUtAndEmissaryStrategies/1_sitesTreeSutAuthenticationPopulation/index.js

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Copyright (C) 2017-2022 BinaryMist Limited. All rights reserved.
2+
3+
// Use of this software is governed by the Business Source License
4+
// included in the file /licenses/bsl.md
5+
6+
// As of the Change Date specified in that file, in accordance with
7+
// the Business Source License, use of this software will be governed
8+
// by the Apache License, Version 2.0
9+
10+
import FormStandard from './formStandard.js';
11+
import Link from './link.js';
12+
import NoAuthentication from './noAuthentication.js';
13+
14+
export default { FormStandard, Link, NoAuthentication };
15+

‎sUtAndEmissaryStrategies/1_sitesTreeSutAuthenticationPopulation/link.js

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// Copyright (C) 2017-2022 BinaryMist Limited. All rights reserved.
2+
3+
// Use of this software is governed by the Business Source License
4+
// included in the file /licenses/bsl.md
5+
6+
// As of the Change Date specified in that file, in accordance with
7+
// the Business Source License, use of this software will be governed
8+
// by the Apache License, Version 2.0
9+
10+
import SitesTreeSutAuthenticationPopulation from './strategy.js';
11+
12+
class Link extends SitesTreeSutAuthenticationPopulation {
13+
#fileName = 'link';
14+
15+
constructor({ log, baseUrl, browser, sutPropertiesSubSet }) {
16+
super({ log, baseUrl, browser, sutPropertiesSubSet });
17+
}
18+
19+
async authenticate() {
20+
const methodName = 'authenticate';
21+
const { checkAndNotifyBuildUserIfAnyKnownBrowserErrors, checkUserIsAuthenticated } = this.browser;
22+
const { authentication: { route: loginRoute, expectedPageSourceSuccess } } = this.sutPropertiesSubSet;
23+
24+
this.log.info(`The ${methodName}() method of the ${super.constructor.name} strategy "${this.constructor.name}" has been invoked.`, { tags: [this.#fileName, methodName] });
25+
26+
const webDriver = this.browser.getWebDriver();
27+
await webDriver.getWindowHandle();
28+
await webDriver.get(`${this.baseUrl}${loginRoute}`);
29+
await checkAndNotifyBuildUserIfAnyKnownBrowserErrors();
30+
await checkUserIsAuthenticated(expectedPageSourceSuccess);
31+
}
32+
}
33+
34+
export default Link;

‎sUtAndEmissaryStrategies/1_sitesTreeSutAuthenticationPopulation/noAuthentication.js

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import SitesTreeSutAuthenticationPopulation from './strategy.js';
2+
3+
class NoAuthentication extends SitesTreeSutAuthenticationPopulation {
4+
#fileName = 'noAuthentication';
5+
6+
constructor({ log, baseUrl, browser, sutPropertiesSubSet }) {
7+
super({ log, baseUrl, browser, sutPropertiesSubSet });
8+
}
9+
10+
async authenticate() {
11+
const methodName = 'authenticate';
12+
13+
this.log.info(`The ${methodName}() method of the ${super.constructor.name} strategy "${this.constructor.name}" has been invoked.`, { tags: [this.#fileName, methodName] });
14+
}
15+
}
16+
17+
export default NoAuthentication;

‎sUtAndEmissaryStrategies/1_sitesTreeSutAuthenticationPopulation/strategy.js

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Copyright (C) 2017-2022 BinaryMist Limited. All rights reserved.
2+
3+
// Use of this software is governed by the Business Source License
4+
// included in the file /licenses/bsl.md
5+
6+
// As of the Change Date specified in that file, in accordance with
7+
// the Business Source License, use of this software will be governed
8+
// by the Apache License, Version 2.0
9+
10+
// Probably BrowserApp only.
11+
class SitesTreeSutAuthenticationPopulation {
12+
constructor({ log, baseUrl, browser, sutPropertiesSubSet }) {
13+
if (this.constructor === SitesTreeSutAuthenticationPopulation) throw new Error('Abstract classes can\'t be instantiated.');
14+
this.log = log;
15+
this.baseUrl = baseUrl;
16+
this.browser = browser;
17+
this.sutPropertiesSubSet = sutPropertiesSubSet;
18+
}
19+
20+
async authenticate() {
21+
throw new Error(`Method "authenticate()" of ${this.constructor.name} is abstract.`);
22+
}
23+
}
24+
25+
export default SitesTreeSutAuthenticationPopulation;

0 commit comments

Comments
 (0)
Failed to load comments.