Introduction:
As part of the Java Test Automation framework migration into JavaScript using Cypress, we had to also perform security testing. This project covers my work to implement security testing for the eCommerce product.
The following are tools I used to implement security testing:
Dependabot
Dependabot is a security testing tool which can be integrated into Github actions to create pull requests (PRs) and keep dependencies secure and up-to-date. Dependabot has been acquired by Github and it’s free of charge. It sends PRs to your projects against dependencies whenever they change. It pulls down dependency files and looks for any outdated or insecure requirements. If any dependencies are out-of-date, Dependabot opens individual pull requests to update each one, review and check your tests have passed, scan the included changelog and release notes, then merge with confidence.
Penetration
Testing
According to Zapproxy website, Security Testing is the
process of assessing and testing a system to discover security risks and vulnerabilities
of the system and its data.
Security Testing can be broken down into 4 categories:
Vulnerability Assessment – When the system is scanned and
analysed for security issues.
Penetration Testing – When the system undergoes attack
and analysis from simulated malicious attackers.
Runtime Testing -When the end-user analyses and performs
security testing on the system.
Code Review: Detailed analysis and review of the system code
for security vulnerabilities.
In this penetrating testing, I am the attacker looking to
break into the system in the hope to steal data or carry out some sort of denial-of-service
attack on the system.
Stages
of Pentesting
Explore – As a tester, I will attempt and learn about
what sort of system I testing, it’s endpoints, the software in use, any patches
installed, searching site for hidden content, known vulnerabilities and
indications of weaknesses.
Attack – As a tester, I will be attempting to explore and
prove that known vulnerabilities exist.
Report – I will report back results including vulnerabilities,
how it was explored and how difficult it was and the severity of the
exploration.
Ultimately the goal is to search for vulnerabilities so these
can be addressed. Also, it can be done to confirm the system is not vulnerable
to a known class or specific defects or verify that a known vulnerability has
been fixed.
Zap is an open-source pentest tool, ideal for beginners
but also used by professionals. Ideal to use for automating tests, and it works
well with other tools.
Active
and Passive Scanners
The passive scanner just examines the requests and responses,
but it can still detect certain types of problems just on that basis. The
passive scanner runs all of the time, and it's completely safe to use on any
site as it does not perform any attacks.
The active scanner performs a wide range of attacks and
should only be used on apps you have
permission to test. It is a real attack and can put targets at risk.
Spider - can be used to crawl the app, for example, to
find pages that you have missed, have been hidden from you. It can also enter
basic default data onto forms.
For Ajax Applications use Zap’ AJAX spider.
Report Generation – Report on issues found, including advice and links for more info about the problems and how to solve them.
To start using Zap for pen-testing, I downloaded the Zap pentest tool, I followed the instructions to install it.
Scenarios:-
1. 1. Traditional
Spider and Ajax Scan
I selected ‘no to
persist at the moment’, clicked on the start
button and chose the ‘Automated scan’
button via the Quick Start tab. I
entered our test URL for the URL to
attack. I left default settings for ‘Use traditional spider’, ticked, left
the ‘Use ajax spider’, checkbox as ticked, and selected chrome as the
browser. I then clicked on the ‘Attack’
button.
This selection carries out a crawl attack using a spider
and passive scan. The traditional spider will discover links by examining the
HTML in the response from the web application. Then since our websites make use
of AJAX applications, I chose the ‘Use ajax spider’, as it’s likely to
be more effective, by exploring the web application and following the links the
Ajax generates. After the scan was completed, I generated an HTML report under
the Report menu for the stakeholders:
The above report shows the severity of the alert, the
URL, Description, and the source solution to the problem. This will be useful
to the stakeholders. The above report only covers spider and Ajax spider scan.
1. 2. An
Active scan
Below is the
HTML generated Report.
1. 3. Full
manual scan
The manual scan provides the user with the Head Unit
Display Interface of which users can view the automation execution of the scan.
Integrating
Zap into GitHub Actions
GitHub Actions lets you create scripts that trigger
events on repositories, making it easy to automate security testing using Zap. Using
Zap baseline-actions, we can configure it to periodically scan public and
private websites. The action can update issues and close issues when alerts are
resolved.
To integrate Zap into GitHub Actions, I started by
creating a new workflow -zap_scan in the folder .github/workflow,
then I created a pull request(see image below:).
Meaning GitHub Actions job should be triggered when the above or any test branch is pushed into the repository.
Comments
Post a Comment