Skip to content

Commit 18e70a4

Browse files
pmstsspmstss
authored
feat(scan): test ids as strings (#185)
1 parent 9677752 commit 18e70a4

File tree

20 files changed

+51
-264
lines changed

20 files changed

+51
-264
lines changed

‎src/SecTester.Core/Dispatchers/HttpCommandDispatcher.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@
66
using System.Threading;
77
using System.Threading.Tasks;
88
using SecTester.Core.Bus;
9-
using SecTester.Core.Utils;
109
using SecTester.Core.Commands;
1110
using SecTester.Core.Extensions;
11+
using SecTester.Core.Utils;
1212

1313
namespace SecTester.Core.Dispatchers;
1414

‎src/SecTester.Repeater/Extensions/ServiceCollectionExtensions.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
using System.Net.Http;
55
using Microsoft.Extensions.DependencyInjection;
66
using SecTester.Core.Extensions;
7-
using SecTester.Core.Utils;
87
using SecTester.Repeater.Api;
98
using SecTester.Repeater.Bus;
109
using SecTester.Repeater.Runners;

‎src/SecTester.Runner/README.md

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -67,23 +67,23 @@ To start scanning your application, first you have to create a `SecScan` instanc
6767

6868
```csharp
6969
await using var scan = await runner.CreateScan(new ScanSettingsBuilder()
70-
.WithTests(new List<TestType> { TestType.CrossSiteScripting }));
70+
.WithTests(new List<string> { "xss" }));
7171
```
7272

7373
Below you will find a list of parameters that can be used to configure a `Scan`:
7474

75-
| Option | Description |
76-
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
77-
| `Target` | The target that will be attacked. For details, see [here](#defining-a-target-for-attack). |
78-
| `Tests` | The list of tests to be performed against the target application. [Learn more about tests](https://docs.brightsec.com/docs/vulnerability-guide) |
79-
| `RepeaterId` | Connects the scan to a Repeater agent, which provides secure access to local networks. |
80-
| `Smart` | Minimize scan time by using automatic smart decisions regarding parameter skipping, detection phases, etc. Enabled by default. |
81-
| `SkipStaticParams` | Use an advanced algorithm to automatically determine if a parameter has any effect on the target system's behavior when changed, and skip testing such static parameters. Enabled by default. |
82-
| `PoolSize` | Sets the maximum concurrent requests for the scan, to control the load on your server. By default, `10`. |
83-
| `AttackParamLocations` | Defines which part of the request to attack. By default, `body`, `query`, and `fragment`. |
84-
| `SlowEpTimeout` | Automatically validate entry-point response time before initiating the vulnerability testing, and reduce scan time by skipping any entry-points that take too long to respond. By default, 1000ms. |
85-
| `TargetTimeout` | Measure timeout responses from the target application globally, and stop the scan if the target is unresponsive for longer than the specified time. By default, 5min. |
86-
| `Name` | The scan name. The method and hostname by default, e.g. `GET example.com`. |
75+
| Option | Description |
76+
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
77+
| `Target` | The target that will be attacked. For details, see [here](#defining-a-target-for-attack). |
78+
| `Tests` | The list of tests to be performed against the target application. To retrieve the complete list, send a request to the [API](https://app.brightsec.com/api/v1/scans/tests). [Learn more about tests](https://docs.brightsec.com/docs/vulnerability-guide). |
79+
| `RepeaterId` | Connects the scan to a Repeater agent, which provides secure access to local networks. |
80+
| `Smart` | Minimize scan time by using automatic smart decisions regarding parameter skipping, detection phases, etc. Enabled by default. |
81+
| `SkipStaticParams` | Use an advanced algorithm to automatically determine if a parameter has any effect on the target system's behavior when changed, and skip testing such static parameters. Enabled by default. |
82+
| `PoolSize` | Sets the maximum concurrent requests for the scan, to control the load on your server. By default, `10`. |
83+
| `AttackParamLocations` | Defines which part of the request to attack. By default, `body`, `query`, and `fragment`. |
84+
| `SlowEpTimeout` | Automatically validate entry-point response time before initiating the vulnerability testing, and reduce scan time by skipping any entry-points that take too long to respond. By default, 1000ms. |
85+
| `TargetTimeout` | Measure timeout responses from the target application globally, and stop the scan if the target is unresponsive for longer than the specified time. By default, 5min. |
86+
| `Name` | The scan name. The method and hostname by default, e.g. `GET example.com`. |
8787

8888
We provide a fluent interface for building a `ScanSettings` object. To use it, you start by creating a `ScanSettingsBuilder` instance, and then you call its methods to specify the various settings you want to use for the scan as shown above.
8989

@@ -162,7 +162,7 @@ public class OrdersApiTests : IClassFixture<SecRunnerFixture>, IAsyncDisposable
162162
_test = _fixture
163163
.Runner
164164
.CreateScan(new ScanSettingsBuilder()
165-
.WithTests(new List<TestType> { TestType.CrossSiteScripting }))
165+
.WithTests(new List<string> { "xss" }))
166166
.Threshold(Severity.Medium)
167167
.Timeout(TimeSpan.FromMinutes(5));
168168
}

‎src/SecTester.Scan/Models/ScanConfig.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ public record ScanConfig(string Name)
77
{
88
public string Name { get; } = Name ?? throw new ArgumentNullException(nameof(Name));
99
public Module? Module { get; init; }
10-
public IEnumerable<TestType>? Tests { get; init; }
10+
public IEnumerable<string>? Tests { get; init; }
1111
public IEnumerable<Discovery>? DiscoveryTypes { get; init; }
1212
public int? PoolSize { get; init; }
1313
public IEnumerable<AttackParamLocation>? AttackParamLocations { get; init; }

‎src/SecTester.Scan/Models/TestType.cs

Lines changed: 0 additions & 136 deletions
This file was deleted.

‎src/SecTester.Scan/README.md

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -33,23 +33,23 @@ The factory exposes the `CreateScan` method that returns a new [Scan instance](#
3333
```csharp
3434
await using var result = scanFactory.CreateScan(new ScanSettings(
3535
target,
36-
new List<TestType>() { TestType.CrossSiteScripting }));
36+
new List<string>() { "xss" }));
3737
```
3838

3939
Below you will find a list of parameters that can be used to configure a `Scan`:
4040

41-
| Option | Description |
42-
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
43-
| `Target` | The target that will be attacked. For details, see [here](#defining-a-target-for-attack). |
44-
| `Tests` | The list of tests to be performed against the target application. [Learn more about tests](https://docs.brightsec.com/docs/vulnerability-guide) |
45-
| `RepeaterId` | Connects the scan to a Repeater agent, which provides secure access to local networks. |
46-
| `Smart` | Minimize scan time by using automatic smart decisions regarding parameter skipping, detection phases, etc. Enabled by default. |
47-
| `SkipStaticParams` | Use an advanced algorithm to automatically determine if a parameter has any effect on the target system's behavior when changed, and skip testing such static parameters. Enabled by default. |
48-
| `PoolSize` | Sets the maximum concurrent requests for the scan, to control the load on your server. By default, `10`. |
49-
| `AttackParamLocations` | Defines which part of the request to attack. By default, `body`, `query`, and `fragment`. |
50-
| `SlowEpTimeout` | Automatically validate entry-point response time before initiating the vulnerability testing, and reduce scan time by skipping any entry-points that take too long to respond. By default, 1000ms. |
51-
| `TargetTimeout` | Measure timeout responses from the target application globally, and stop the scan if the target is unresponsive for longer than the specified time. By default, 5min. |
52-
| `Name` | The scan name. The method and hostname by default, e.g. `GET example.com`. |
41+
| Option | Description |
42+
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
43+
| `Target` | The target that will be attacked. For details, see [here](#defining-a-target-for-attack). |
44+
| `Tests` | The list of tests to be performed against the target application. To retrieve the complete list, send a request to the [API](https://app.brightsec.com/api/v1/scans/tests). [Learn more about tests](https://docs.brightsec.com/docs/vulnerability-guide). |
45+
| `RepeaterId` | Connects the scan to a Repeater agent, which provides secure access to local networks. |
46+
| `Smart` | Minimize scan time by using automatic smart decisions regarding parameter skipping, detection phases, etc. Enabled by default. |
47+
| `SkipStaticParams` | Use an advanced algorithm to automatically determine if a parameter has any effect on the target system's behavior when changed, and skip testing such static parameters. Enabled by default. |
48+
| `PoolSize` | Sets the maximum concurrent requests for the scan, to control the load on your server. By default, `10`. |
49+
| `AttackParamLocations` | Defines which part of the request to attack. By default, `body`, `query`, and `fragment`. |
50+
| `SlowEpTimeout` | Automatically validate entry-point response time before initiating the vulnerability testing, and reduce scan time by skipping any entry-points that take too long to respond. By default, 1000ms. |
51+
| `TargetTimeout` | Measure timeout responses from the target application globally, and stop the scan if the target is unresponsive for longer than the specified time. By default, 5min. |
52+
| `Name` | The scan name. The method and hostname by default, e.g. `GET example.com`. |
5353

5454
We provide a fluent interface for building a `ScanSettings` object. To use it, you start by creating a `ScanSettingsBuilder` instance, and then you call its methods to specify the various settings you want to use for the scan.
5555

‎src/SecTester.Scan/ScanSettings.cs

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,10 @@ public sealed record ScanSettings
2020
private readonly int? _poolSize;
2121
private readonly TimeSpan? _slowEpTimeout;
2222
private readonly TimeSpan? _targetTimeout;
23-
private readonly IEnumerable<TestType> _tests;
23+
private readonly IEnumerable<string> _tests;
2424
private readonly Target _target;
2525

26-
public ScanSettings(string name, Target target, IEnumerable<TestType> tests)
26+
public ScanSettings(string name, Target target, IEnumerable<string> tests)
2727
{
2828
Name = name;
2929
Target = target;
@@ -132,7 +132,7 @@ public TimeSpan? TargetTimeout
132132
/// <summary>
133133
/// The list of tests to be performed against the target application
134134
/// </summary>
135-
public IEnumerable<TestType> Tests
135+
public IEnumerable<string> Tests
136136
{
137137
get => _tests;
138138
init
@@ -142,11 +142,6 @@ public IEnumerable<TestType> Tests
142142
throw new ArgumentNullException(nameof(Tests));
143143
}
144144

145-
if (value.Any(x => !Enum.IsDefined(typeof(TestType), x)))
146-
{
147-
throw new ArgumentException("Unknown test type supplied.");
148-
}
149-
150145
var unique = value.Distinct().ToArray();
151146

152147
if (!unique.Any())

‎src/SecTester.Scan/ScanSettingsBuilder.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ public class ScanSettingsBuilder
1919
private bool _smart = true;
2020
private Target? _target;
2121
private TimeSpan _targetTimeout = TimeSpan.FromMinutes(5);
22-
private IEnumerable<TestType> _tests = new List<TestType>();
22+
private IEnumerable<string> _tests = new List<string>();
2323

2424
/// <summary>
2525
/// Sets a target for the scan.
@@ -103,7 +103,7 @@ public ScanSettingsBuilder WithTargetTimeout(TimeSpan value)
103103
/// <summary>
104104
/// Sets a list of tests to run for the scan.
105105
/// </summary>
106-
public ScanSettingsBuilder WithTests(IEnumerable<TestType> value)
106+
public ScanSettingsBuilder WithTests(IEnumerable<string> value)
107107
{
108108
_tests = value;
109109
return this;

‎test/SecTester.Core.Tests/Extensions/HttpResponseMessageExtensionsTests.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
using System.Net;
2-
using System.Text;
32

43
namespace SecTester.Core.Tests.Extensions;
54

‎test/SecTester.Core.Tests/Usings.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,7 @@
2121
global using SecTester.Core.Dispatchers;
2222
global using SecTester.Core.Exceptions;
2323
global using SecTester.Core.Extensions;
24-
global using SecTester.Core.RetryStrategies;
25-
global using SecTester.Core.Exceptions;
2624
global using SecTester.Core.Logger;
25+
global using SecTester.Core.RetryStrategies;
2726
global using SecTester.Core.Utils;
2827
global using Xunit;

0 commit comments

Comments
 (0)