CODEWITHSUNDEEP
automationautomated-testsgitlabgitlab-cizap
t30_9
t30_9

Reputation: 499

Automated Security Test in GitLab

i'm trying to implement automation inside my GitLab project.

In order to perform security scan, i would like to use ZAP to go through all the URLs present in the project and scan them. It's clearly not possible to pass manually all the URLs, so i'm trying to find a way to make all the test as automated as possible.

The problem is: how to reach all the URLs present in the application?

I thought a way could be to pass them as a "variable" in the YML file, and use them as parameter in the ZAP command, something like that (see below).

Is this a reasonable solution? Is there any other way to perform an automated scan inside a repository (without passing manually the URLs)? Thanks 

variables:
  OWASP_CONTAINER: $APP_NAME-$BUILD_ID-OWASP
  OWASP_IMAGE: "owasp/zap2docker-stable"
  OWASP_REPORT_DIR: "owasp-data"
  ZAP_API_PORT: "8090"
  PENTEST_IP: 'application:8080'

run penetration tests:
 stage: pen-tests
 image: docker:stable

    - docker exec $OWASP_CONTAINER zap-cli -v -p $ZAP_API_PORT active-scan http://$PENTEST_IP/html

Upvotes: 1

Views: 561

Answers (1)

Jon Skarpeteig
Jon Skarpeteig

Reputation: 4128

You need to turn on a new feature flag (FF_NETWORK_PER_BUILD) to enable a network per build. Then also services can reach each others (Available since GitLab runner 12.9). For more information see: https://docs.gitlab.com/runner/executors/docker.html#networking

Working example owasp zap job in GitLab CI:

owasp-zap:
  variables:
    FF_NETWORK_PER_BUILD: 1
  image: maven
  services:
    - selenium/standalone-chrome
    - name: owasp/zap2docker-weekly
      entrypoint: ['zap.sh', '-daemon', '-host', '0.0.0.0', '-port', '8080',
          '-config', 'api.addrs.addr.name=.*', '-config', 'api.addrs.addr.regex=true', '-config', 'api.key=1234567890']
  script:
    - sleep 5
    - mvn clean test -Dbrowser=chrome -Dgrid_url=http://selenium-standalone-chrome:4444/wd/hub -Dproxy=http://owasp-zap2docker-weekly:8080
    - curl http://owasp-zap2docker-weekly:8080/OTHER/core/other/htmlreport/?apikey=1234567890 -o report.html
  artifacts:
    paths:
      - report.html

Upvotes: 1

Related Questions