secureCodeBox · J12934 · Feb 13, 2019 · Feb 1, 2019 · Feb 1, 2019 · Feb 1, 2019
diff --git a/.env b/.env
@@ -15,4 +15,10 @@ DEFAULT_TAG=latest
 # Even when they are disabled here they might still be started (depending on the way you start your compose stack)
 # This flag just changes if the engine writes results into the providers
 ENABLE_ELASTICSEARCH=true
-ENABLE_DEFECT_DOJO=true
+ENABLE_DEFECT_DOJO=true
+
+# Admin User Configuration
+# By default you will be asked to set the admin password on first login. 
+# It can be set automatically by filling the following env vars.
+CAMUNDA_BPM_ADMIN_USER_ID=-
+CAMUNDA_BPM_ADMIN_USER_PASSWORD=-
diff --git a/.travis.yml b/.travis.yml
@@ -0,0 +1,37 @@
+language: node_js
+node_js:
+  - '10'
+services:
+  - docker
+env:
+  #  - DEFAULT_TAG=latest
+  - DEFAULT_TAG=develop
+script:
+  - cp test/.env.test .env
+  - docker-compose -f docker-compose.yml -f docker-compose.demo.yml up -d engine camundadb bodgeit juice-shop nginx scanner-infrastructure-nmap scanner-webapplication-arachni scanner-webapplication-zap scanner-infrastructure-amass scanner-webapplication-sslyze scanner-webserver-nikto
+  - cd test
+  - npm ci
+  - npm test -- --verbose --forceExit
+after_failure:
+  - docker ps -a
+  - echo -en "travis_fold:start:EngineLogs\r"
+  - docker logs securecodebox_engine_1
+  - echo -en "travis_fold:end:EngineLogs\r"
+  - echo -en "travis_fold:start:ZapLogs\r"
+  - docker logs securecodebox_scanner-webapplication-zap_1
+  - echo -en "travis_fold:end:ZapLogs\r"
+  - echo -en "travis_fold:start:ArachniLogs\r"
+  - docker logs securecodebox_scanner-webapplication-arachni_1
+  - echo -en "travis_fold:end:ArachniLogs\r"
+  - echo -en "travis_fold:start:AmassLogs\r"
+  - docker logs securecodebox_scanner-infrastructure-amass_1
+  - echo -en "travis_fold:end:AmassLogs\r"
+  - echo -en "travis_fold:start:NmapLogs\r"
+  - docker logs securecodebox_scanner-infrastructure-nmap_1
+  - echo -en "travis_fold:end:NmapLogs\r"
+  - echo -en "travis_fold:start:SSLyzeLogs\r"
+  - docker logs securecodebox_scanner-webapplication-sslyze_1
+  - echo -en "travis_fold:end:SSLyzeLogs\r"
+  - echo -en "travis_fold:start:NiktoLogs\r"
+  - docker logs securecodebox_scanner-webserver-nikto_1
+  - echo -en "travis_fold:end:NiktoLogs\r"
diff --git a/docker-compose.demo.yml b/docker-compose.demo.yml
@@ -1,4 +1,4 @@
-version: '3'
+version: '2.1'
 services:
   juice-shop:
     image: bkimminich/juice-shop

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -1,4 +1,4 @@
-version: '3'
+version: '2.1'
 services:
   engine:
     image: securecodebox/engine:${DEFAULT_TAG}
@@ -34,6 +34,9 @@ services:
       - SECURECODEBOX_DEFAULT_CONTEXT=JuiceShop Test Scan
       - SECURECODEBOX_USER_SCANNER=${ENGINE_SCANNERSERVICES_USER}
       - SECURECODEBOX_USER_SCANNER_PW=${ENGINE_SCANNERSERVICES_PASSWORD}
+      # Admin User setup
+      - CAMUNDA_BPM_ADMIN-USER_ID=${CAMUNDA_BPM_ADMIN_USER_ID}
+      - CAMUNDA_BPM_ADMIN-USER_PASSWORD=${CAMUNDA_BPM_ADMIN_USER_PASSWORD}
     restart: on-failure:3
 
   camundadb:
@@ -54,7 +57,8 @@ services:
   scanner-infrastructure-nmap:
     image: securecodebox/nmap:${DEFAULT_TAG}
     depends_on:
-      - engine
+      engine:
+        condition: service_healthy 
     networks:
       - frontend
     labels:
@@ -67,7 +71,8 @@ services:
   scanner-webserver-nikto:
     image: securecodebox/nikto:${DEFAULT_TAG}
     depends_on:
-      - engine
+      engine:
+        condition: service_healthy 
     networks:
       - frontend
     labels:
@@ -80,7 +85,8 @@ services:
   scanner-webapplication-zap:
       image: securecodebox/zap:${DEFAULT_TAG}
       depends_on:
-        - engine
+        engine:
+          condition: service_healthy 
       networks:
         - frontend
       labels:
@@ -94,7 +100,8 @@ services:
   scanner-webapplication-sslyze:
       image: securecodebox/sslyze:${DEFAULT_TAG}
       depends_on:
-        - engine
+        engine:
+          condition: service_healthy 
       networks:
         - frontend
       labels:
@@ -107,7 +114,8 @@ services:
   scanner-webapplication-arachni:
       image: securecodebox/arachni:${DEFAULT_TAG}
       depends_on:
-        - engine
+        engine:
+          condition: service_healthy
       networks:
         - frontend
       labels:
@@ -122,7 +130,8 @@ services:
   scanner-infrastructure-amass:
       image: securecodebox/amass:${DEFAULT_TAG}
       depends_on:
-        - engine
+        engine:
+          condition: service_healthy
       networks:
         - frontend
       labels:

diff --git a/test/.env.test b/test/.env.test
@@ -0,0 +1,24 @@
+CAMUNDADB_DATABASE=camundadb
+CAMUNDADB_ROOT_PW=root
+CAMUNDADB_USER=camunda
+CAMUNDADB_PW=secret
+
+ENGINE_SCANNERSERVICES_USER=defaultScanner
+ENGINE_SCANNERSERVICES_PASSWORD=scan
+
+DEFECT_DOJO_API_KEY=your-defect-dojo-api-key-here
+
+# Default Image Tag. Latest will always be the most recent stable release.
+DEFAULT_TAG=develop
+
+# Enabling the Persistence Providers inside then Engine Container
+# Even when they are disabled here they might still be started (depending on the way you start your compose stack)
+# This flag just changes if the engine writes results into the providers
+ENABLE_ELASTICSEARCH=false
+ENABLE_DEFECT_DOJO=false
+
+# Admin User Configuration
+# By default you will be asked to set the admin password on first login. 
+# It can be set automatically by filling the following env vars.
+CAMUNDA_BPM_ADMIN_USER_ID=kermit
+CAMUNDA_BPM_ADMIN_USER_PASSWORD=a
diff --git a/test/.gitignore b/test/.gitignore
@@ -0,0 +1 @@
+node_modules/
diff --git a/test/amass.test.js b/test/amass.test.js
@@ -0,0 +1,32 @@
+const { startSecurityTest, Time } = require('./sdk');
+
+test(
+  'finds subdomains for securecodebox.io',
+  async () => {
+    const securityTest = await startSecurityTest({
+      context: 'securecodebox.io subdomains',
+      metaData: {},
+      name: 'amass',
+      target: {
+        name: 'securecodebox.io',
+        location: 'securecodebox.io',
+        attributes: {},
+      },
+    });
+
+    const {
+      report: { findings },
+    } = securityTest;
+
+    // Should find at least a couple of subdomains
+    expect(findings.length).toBeGreaterThan(5);
+
+    // Should all end on "*.securecodebox.io"
+    for (const finding of findings) {
+      expect(finding.location).toEqual(
+        expect.stringMatching(/.*\.securecodebox.io$/)
+      );
+    }
+  },
+  5 * Time.Minute
+);
diff --git a/test/arachni.test.js b/test/arachni.test.js
@@ -0,0 +1,40 @@
+const { startSecurityTest, Time } = require('./sdk');
+
+test(
+  'finds a few findings for a bare nginx container',
+  async () => {
+    const securityTest = await startSecurityTest({
+      context: 'nginx bare',
+      metaData: {},
+      name: 'arachni',
+      target: {
+        name: 'nginx bare',
+        location: 'http://nginx',
+        attributes: {},
+      },
+    });
+
+    const { report } = securityTest;
+
+    const findings = report.findings.map(({ name, category, severity }) => ({
+      name,
+      category,
+      severity,
+    }));
+
+    expect(findings).toContainEqual({
+      name: "Missing 'X-Frame-Options' header",
+      category: 'Missing X-Frame-Options header',
+      severity: 'LOW',
+    });
+
+    expect(findings).toContainEqual({
+      name: 'Interesting response',
+      category: 'Interesting responses',
+      severity: 'INFORMATIONAL',
+    });
+
+    expect(findings.length).toEqual(2);
+  },
+  5 * Time.Minute
+);
diff --git a/test/nikto.test.js b/test/nikto.test.js
@@ -0,0 +1,30 @@
+const { startSecurityTest, Time } = require('./sdk');
+
+test.skip(
+  'finds a few findings for juice-shop',
+  async () => {
+    const securityTest = await startSecurityTest({
+      context: 'bodgeit webserver',
+      metaData: {},
+      name: 'nikto',
+      target: {
+        name: 'BodgeIt',
+        location: 'bodgeit',
+        attributes: {
+          NIKTO_PORTS: '8080',
+        },
+      },
+    });
+
+    const { report } = securityTest;
+
+    const findings = report.findings.map(({ name, category, severity }) => ({
+      name,
+      category,
+      severity,
+    }));
+
+    console.log(report.findings);
+  },
+  5 * Time.Minute
+);
diff --git a/test/nmap.test.js b/test/nmap.test.js
@@ -0,0 +1,84 @@
+const { startSecurityTest, Time } = require('./sdk');
+
+test(
+  'finds open 3000 port of juiceshop',
+  async () => {
+    const securityTest = await startSecurityTest({
+      context: 'JuiceShopPortScan',
+      metaData: {},
+      name: 'nmap',
+      target: {
+        name: 'JuiceShop Container',
+        location: 'juice-shop',
+        attributes: {
+          NMAP_PARAMETER: '-Pn',
+        },
+      },
+    });
+
+    const { report } = securityTest;
+
+    const findings = report.findings.map(
+      ({ description, category, name, osi_layer, severity }) => ({
+        description,
+        category,
+        name,
+        osi_layer,
+        severity,
+      })
+    );
+
+    expect(findings).toContainEqual({
+      description: 'Port 3000 is open using tcp protocol.',
+      category: 'Open Port',
+      name: 'ppp',
+      osi_layer: 'NETWORK',
+      severity: 'INFORMATIONAL',
+    });
+
+    expect(findings.length).toBe(1);
+  },
+  1 * Time.Minute
+);
+
+test(
+  'finds 3 open ports of bodgeit',
+  async () => {
+    const securityTest = await startSecurityTest({
+      context: 'BodgeItPortScan',
+      metaData: {},
+      name: 'nmap',
+      target: {
+        name: 'BodgeIt Container',
+        location: 'bodgeit',
+        attributes: {
+          NMAP_PARAMETER: '-Pn',
+        },
+      },
+    });
+
+    const { report } = securityTest;
+    const [finding1, finding2, finding3, ...otherFindings] = report.findings;
+
+    expect(finding1).toMatchObject({
+      description: 'Port 8009 is open using tcp protocol.',
+      category: 'Open Port',
+      severity: 'INFORMATIONAL',
+    });
+
+    expect(finding2).toMatchObject({
+      description: 'Port 8080 is open using tcp protocol.',
+      category: 'Open Port',
+      severity: 'INFORMATIONAL',
+    });
+
+    expect(finding3).toMatchObject({
+      description: 'Port 8443 is open using tcp protocol.',
+      category: 'Open Port',
+      severity: 'INFORMATIONAL',
+    });
+
+    expect(otherFindings).toEqual([]);
+  },
+  1 * Time.Minute
+);