Skip to content

Commit

Permalink
refactor(reports):
Browse files Browse the repository at this point in the history
Remove reports from Job files.
Add Job file which completes a Test Run in under 2 minutes.
Update README files
  • Loading branch information
binarymist committed May 5, 2023
1 parent 234797e commit 1d7a724
Showing 6 changed files with 69 additions and 14 deletions.
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -2,5 +2,6 @@ jobs/*

!jobs/README.md
!jobs/simple-BrowserApp-job-example
!jobs/simple-BrowserApp-job-fast-example
!jobs/advanced-BrowserApp-job-example

2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -2,6 +2,6 @@

This repository contains:

* Example _Job_ files, useful for customizing for consumption of the GuardRails application testing engine
* Example [_Job_](https://docs.guardrails.io/docs/glossary#job) files, useful for customizing, and for consumption from the GuardRails [_Application Testing Engine_](https://docs.guardrails.io/docs/glossary#application-testing-engine)


5 changes: 3 additions & 2 deletions jobs/README.md
Original file line number Diff line number Diff line change
@@ -2,6 +2,7 @@ Documentation around the _Job_ file structure can be found at https://docs.guard

Examples of _Job_ files can be found at https://github.com/guardrailsio/runtime-resources/tree/main/jobs

* advanced-BrowserApp-job-example: This _Job_ file targets the [NodeGoat](https://github.com/OWASP/NodeGoat) SUT, which we host using [purpleteam-iac-sut](https://github.com/purpleteam-labs/purpleteam-iac-sut). You can use this _Job_ file and just update the `sutHost` to point to your hosted copy of NodeGoat as well as the `username` and `password` properties. If you are curious as to what the varius strategies do, you can read through their source code. For example the `sutAuthentication: { sitesTreeSutAuthenticationPopulationStrategy: FormStandard } can be found [here](https://github.com/guardrailsio/runtime-resources/blob/main/sUtAndEmissaryStrategies/1_sitesTreeSutAuthenticationPopulation/formStandard.js)
* simple-BrowserApp-job-example: This _Job_ file is good for most browser applications that don't require authentication. If using this _Job_ file, you will need to provide a valid `sutHost` property value. As it is, it will inform the application testing engine to scan the specified host from the root. If you want to be more specific, you can add routes to be scanned
* advanced-BrowserApp-job-example: This _Job_ file targets the [NodeGoat](https://github.com/OWASP/NodeGoat) SUT, which we host using [purpleteam-iac-sut](https://github.com/purpleteam-labs/purpleteam-iac-sut). You can use this _Job_ file and just update the `sutHost` to point to your hosted copy of NodeGoat as well as the `username` and `password` properties
* simple-BrowserApp-job-example: This _Job_ file is good for most browser applications that don't require authentication. If using this _Job_ file, you will need to provide a valid `sutHost` property value. As it is, it will inform the _Application Testing Engine_ to scan the specified host from the root. If you want to be more specific, you can add routes to be scanned
* simple-BrowserApp-job-fast-example: This _Job_ file extends simple-BrowserApp-job-example by adding a single route, this will inform the _Application Testing Engine_ to only scan the specified route of the specified host. You will need to provide a valid `sutHost` property value, and a valid `route.id` property value. By using this _Job_, the [_Test Run_](https://docs.guardrails.io/docs/glossary#test-run) should be faster because it is not scanning from the root

5 changes: 0 additions & 5 deletions jobs/advanced-BrowserApp-job-example
Original file line number Diff line number Diff line change
@@ -52,11 +52,6 @@
"scanningStrategy": "BrowserAppStandard",
"postScanningStrategy": "BrowserAppStandard",
"reportingStrategy": "Standard",
"reports": {
"templateThemes": [{
"name": "traditionalJson"
}]
},
"username": "[your-user]",
"password": "[your-password]",
"aScannerAttackStrength": "HIGH",
7 changes: 1 addition & 6 deletions jobs/simple-BrowserApp-job-example
Original file line number Diff line number Diff line change
@@ -7,7 +7,7 @@
"sitesTreeSutAuthenticationPopulationStrategy": "NoAuthentication",
"emissaryAuthenticationStrategy": "NoAuthentication"
},
"sutHost": "[targetdomain.com]",
"sutHost": "<targetdomain.com>",
"sutPort": 443,
"sutProtocol": "https",
"browser": "chrome"
@@ -42,11 +42,6 @@
"scanningStrategy": "BrowserAppStandard",
"postScanningStrategy": "BrowserAppStandard",
"reportingStrategy": "Standard",
"reports": {
"templateThemes": [{
"name": "traditionalJson"
}]
},
"aScannerAttackStrength": "HIGH",
"aScannerAlertThreshold": "LOW",
"alertThreshold": 12
63 changes: 63 additions & 0 deletions jobs/simple-BrowserApp-job-fast-example
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
{
"data": {
"type": "BrowserApp",
"attributes": {
"version": "0.0.1",
"sutAuthentication": {
"sitesTreeSutAuthenticationPopulationStrategy": "NoAuthentication",
"emissaryAuthenticationStrategy": "NoAuthentication"
},
"sutHost": "<targetdomain.com>",
"sutPort": 443,
"sutProtocol": "https",
"browser": "chrome"
},
"relationships": {
"data": [{
"type": "tlsScanner",
"id": "NA"
},
{
"type": "appScanner",
"id": "NA"
}]
}
},
"included": [
{
"type": "tlsScanner",
"id": "NA",
"attributes": {
"tlsScannerSeverity": "LOW",
"alertThreshold": 3
}
},
{
"type": "appScanner",
"id": "NA",
"attributes": {
"sitesTreePopulationStrategy": "WebDriverStandard",
"spiderStrategy": "Standard",
"scannersStrategy": "BrowserAppStandard",
"scanningStrategy": "BrowserAppStandard",
"postScanningStrategy": "BrowserAppStandard",
"reportingStrategy": "Standard",
"aScannerAttackStrength": "HIGH",
"aScannerAlertThreshold": "LOW",
"alertThreshold": 12
},
"relationships": {
"data": [{"type": "route", "id": "</my-route>"}]
}
},
{
"type": "route",
"id": "</my-route>",
"attributes": {
"attackFields": [],
"method": "GET",
"submit": ""
}
}
]
}

0 comments on commit 1d7a724

Please sign in to comment.