Skip to content

Commit 2962564

Browse files
TaofeeqibTaofeeqib
committed
DevSecOps test
1 parent 58fde86 commit 2962564

13 files changed

Lines changed: 1204 additions & 33 deletions

‎.github/workflows/devsecops-pipeline.yml‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
name: DevSecOps Pipeline
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches: [ main ]
8+
workflow_dispatch:
9+
10+
jobs:
11+
secrets-scanning:
12+
name: Secrets Scanning
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout code
16+
uses: actions/checkout@v4
17+
with:
18+
fetch-depth: 0
19+
20+
- name: TruffleHog OSS
21+
uses: trufflesecurity/trufflehog@v3.63.7
22+
with:
23+
path: ./
24+
base: ${{ github.event.repository.default_branch }}
25+
head: HEAD
26+
extra_args: --debug --only-verified
27+
28+
sast-scanning:
29+
name: Static Application Security Testing
30+
runs-on: ubuntu-latest
31+
needs: secrets-scanning
32+
steps:
33+
- name: Checkout code
34+
uses: actions/checkout@v4
35+
36+
- name: Semgrep scan
37+
uses: semgrep/semgrep-action@v1
38+
with:
39+
config: >-
40+
p/javascript
41+
p/angular
42+
p/nodejsscan
43+
./xss/semgrep.yaml
44+
./semgrep-custom-rules.yaml
45+
output: semgrep-results.sarif
46+
47+
- name: Upload SARIF file
48+
uses: github/codeql-action/upload-sarif@v2
49+
if: always()
50+
with:
51+
sarif_file: semgrep-results.sarif
52+
53+
sca-scanning:
54+
name: Software Composition Analysis
55+
runs-on: ubuntu-latest
56+
needs: sast-scanning
57+
steps:
58+
- name: Checkout code
59+
uses: actions/checkout@v4
60+
61+
- name: OWASP Dependency-Check Scan - Backend
62+
uses: dependency-check/Dependency-Check_Action@main
63+
with:
64+
project: 'Angular-XSS-Backend'
65+
path: './xss/api'
66+
format: 'SARIF'
67+
out: './reports'
68+
args: >-
69+
--suppression ./dependency-check-suppressions.xml
70+
--scan-config ./dependency-check-config.json
71+
72+
- name: OWASP Dependency-Check Scan - Frontend
73+
uses: dependency-check/Dependency-Check_Action@main
74+
with:
75+
project: 'Angular-XSS-Frontend'
76+
path: './xss/frontend'
77+
format: 'SARIF'
78+
out: './reports'
79+
args: >-
80+
--suppression ./dependency-check-suppressions.xml
81+
--scan-config ./dependency-check-config.json
82+
83+
- name: Upload SARIF files
84+
uses: github/codeql-action/upload-sarif@v2
85+
if: always()
86+
with:
87+
sarif_file: './reports/'
88+
89+
sbom-generation:
90+
name: Software Bill of Materials
91+
runs-on: ubuntu-latest
92+
needs: sca-scanning
93+
steps:
94+
- name: Checkout code
95+
uses: actions/checkout@v4
96+
97+
- name: Generate SBOM with CycloneDX
98+
uses: CycloneDX/gh-node-module-generatebom@master
99+
with:
100+
path: './xss'
101+
output: './angular-xss-sbom.json'
102+
103+
- name: Upload SBOM as artifact
104+
uses: actions/upload-artifact@v3
105+
with:
106+
name: angular-xss-sbom
107+
path: './angular-xss-sbom.json'
108+
109+
dast-scanning:
110+
name: Dynamic Application Security Testing
111+
runs-on: ubuntu-latest
112+
needs: sbom-generation
113+
steps:
114+
- name: Checkout code
115+
uses: actions/checkout@v4
116+
117+
- name: Start Angular XSS application with Docker Compose
118+
run: |
119+
cd ./xss
120+
docker-compose build
121+
docker-compose up -d
122+
# Wait for application to be ready
123+
sleep 60
124+
125+
- name: ZAP Baseline Scan
126+
uses: zaproxy/action-baseline@v0.11.0
127+
with:
128+
target: 'http://localhost:4200'
129+
allow_issue_writing: true
130+
cmd_options: '-a -j -T 10'
131+
rules_file_name: './zap-rules.tsv'
132+
issue_title: 'ZAP Baseline Scan Report'
133+
markdown_report: true
134+
135+
- name: ZAP Full Scan
136+
uses: zaproxy/action-full-scan@v0.8.0
137+
with:
138+
target: 'http://localhost:4200'
139+
allow_issue_writing: true
140+
cmd_options: '-a -j -T 10'
141+
rules_file_name: './zap-rules.tsv'
142+
issue_title: 'ZAP Full Scan Report'
143+
markdown_report: true
144+
145+
- name: Upload ZAP Report
146+
uses: actions/upload-artifact@v3
147+
if: always()
148+
with:
149+
name: zap-reports
150+
path: |
151+
baseline-report.md
152+
full-scan-report.md
153+
154+
- name: Stop Docker Containers
155+
if: always()
156+
run: |
157+
cd ./xss
158+
docker-compose down
159+
160+
defectdojo-import:
161+
name: Import Results to DefectDojo
162+
runs-on: ubuntu-latest
163+
needs: [secrets-scanning, sast-scanning, sca-scanning, sbom-generation, dast-scanning]
164+
steps:
165+
- name: Checkout code
166+
uses: actions/checkout@v4
167+
168+
- name: Download all artifacts
169+
uses: actions/download-artifact@v3
170+
with:
171+
path: ./artifacts
172+
173+
- name: Import to DefectDojo
174+
run: |
175+
chmod +x ./defectdojo/import-results.sh
176+
./defectdojo/import-results.sh ${{ secrets.DEFECTDOJO_URL }} ${{ secrets.DEFECTDOJO_API_KEY }} ${{ secrets.DEFECTDOJO_ENGAGEMENT_ID }}
177+
env:
178+
DEFECTDOJO_URL: ${{ secrets.DEFECTDOJO_URL }}
179+
DEFECTDOJO_API_KEY: ${{ secrets.DEFECTDOJO_API_KEY }}
180+
DEFECTDOJO_ENGAGEMENT_ID: ${{ secrets.DEFECTDOJO_ENGAGEMENT_ID }}

‎README.md‎

Lines changed: 48 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,70 @@
1-
## Cross Site Scripting
1+
# DevSecOps Pipeline for Angular XSS Application
22

3-
* Step 1: Open terminal and switch to project directory
3+
This project implements a comprehensive DevSecOps pipeline for a deliberately vulnerable Angular application to demonstrate security scanning capabilities in CI/CD.
44

5-
```bash
6-
cd /root/angular-xss/xss
7-
```
5+
## Pipeline Architecture
86

9-
* Step 2: Build the docker images for both frontend and the API
7+
The pipeline includes the following security stages:
108

11-
```bash
12-
docker-compose build
13-
```
9+
1. **Secrets Scanning** - Using TruffleHog OSS to detect exposed credentials
10+
2. **Static Application Security Testing (SAST)** - Using Semgrep with JavaScript, Angular, and Node.js rulesets
11+
3. **Software Composition Analysis (SCA)** - Using OWASP Dependency-Check to identify vulnerable dependencies
12+
4. **Software Bill of Materials (SBOM)** - Using CycloneDX to generate a comprehensive inventory of components
13+
5. **Dynamic Application Security Testing (DAST)** - Using OWASP ZAP to perform runtime security testing
14+
6. **Vulnerability Reporting** - Aggregating all findings in DefectDojo
1415

15-
* Step 3: Start the app
16+
![DevSecOps Pipeline Architecture](./docs/images/pipeline-architecture.png)
1617

17-
```bash
18-
docker-compose up -d
19-
```
18+
## Setup Instructions
2019

21-
* Step 4: Access the app on `http://<your-server-ip>:4200`
20+
### Prerequisites
2221

23-
> **Note:** To fetch server ip type in `serverip` in the terminal
22+
- GitHub account
23+
- Docker and Docker Compose installed
24+
- Access to DefectDojo instance (or run locally using provided docker-compose file)
2425

25-
* Step 5: Signup as an admin, Enter some random email id and password, also enable the `Signup as an admin` checkbox
26+
### Running the Pipeline
2627

27-
* Step 6: Now it's time to login as an Admin, While logging in as an Admin enable `Signin as an admin` flag
28+
1. Push your code to GitHub to trigger the workflow
29+
2. Manually trigger the workflow from the GitHub Actions tab
2830

29-
* Step 7: After successful login you should see `Add New Movies` option in the Navigation bar
31+
### Running DefectDojo Locally
3032

31-
* Step 8: Now create some movies using that option
33+
```bash
34+
cd defectdojo
35+
docker-compose up -d
36+
```
3237

33-
* Step 9: While creating a new movies entry in the `Movie Link` input you can add an XSS payload like `javascript:alert("Hacked!")`
38+
Access DefectDojo at http://localhost:8080 with credentials:
39+
- Username: admin
40+
- Password: admin
3441

35-
* Step 10: If you are successful in creating the movie now access the `Movies` tab
42+
## Vulnerability Findings
3643

37-
* Step 11: Now click on the `Click Here` button to see an attack taking place, This should pop up with an alert box stating that it is `Hacked!`
44+
The pipeline is designed to detect:
3845

39-
* Step 12: You can repeat from `Step 9` this time you try with a different payload like `javascript:alert(window.localStorage.getItem('token'))`
46+
1. Secrets and credentials exposed in code
47+
2. XSS vulnerabilities in Angular code
48+
3. Vulnerable dependencies in both frontend and backend
49+
4. Other security issues defined in Semgrep rules
4050

41-
* Step 13: If you are successful in the attack then you should see an alert box with a JWT token value.
51+
## Integration with DefectDojo
4252

43-
### Teardown
53+
Scan results from all security tools are aggregated in DefectDojo for:
54+
- Centralized vulnerability management
55+
- Tracking remediation progress
56+
- Generating comprehensive reports
57+
- Historical security trend analysis
4458

45-
* Step 1: Switch to project directory
59+
## Screenshots
4660

47-
```bash
48-
cd /root/angular-xss/xss
49-
```
61+
See the `docs/screenshots` directory for:
62+
- Successful SAST scan results
63+
- Identified XSS vulnerabilities
64+
- DefectDojo dashboard
5065

51-
* Step 2: Bring down the app
66+
## Future Enhancements
5267

53-
```bash
54-
docker-compose down
55-
```
68+
- Implement container scanning
69+
- Add automated security regression testing
70+
- Enhance Semgrep rules for custom vulnerabilities

‎defectdojo/docker-compose.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
version: '3.7'
2+
3+
services:
4+
mysql:
5+
image: mysql:8.0
6+
environment:
7+
MYSQL_DATABASE: defectdojo
8+
MYSQL_USER: defectdojo
9+
MYSQL_PASSWORD: defectdojo
10+
MYSQL_ROOT_PASSWORD: defectdojo
11+
volumes:
12+
- defectdojo-mysql-data:/var/lib/mysql
13+
restart: always
14+
15+
rabbitmq:
16+
image: rabbitmq:3-management
17+
environment:
18+
RABBITMQ_DEFAULT_USER: defectdojo
19+
RABBITMQ_DEFAULT_PASS: defectdojo
20+
restart: always
21+
volumes:
22+
- defectdojo-rabbitmq-data:/var/lib/rabbitmq
23+
24+
defectdojo:
25+
image: defectdojo/defectdojo-django:latest
26+
depends_on:
27+
- mysql
28+
- rabbitmq
29+
environment:
30+
DD_DATABASE_URL: mysql://defectdojo:defectdojo@mysql:3306/defectdojo
31+
DD_CELERY_BROKER_URL: amqp://defectdojo:defectdojo@rabbitmq:5672/
32+
DD_ADMIN_USER: admin
33+
DD_ADMIN_PASSWORD: admin
34+
DD_ADMIN_MAIL: admin@localhost
35+
DD_ALLOWED_HOSTS: "*"
36+
DD_DEBUG: 'False'
37+
restart: always
38+
ports:
39+
- "8080:8080"
40+
volumes:
41+
- defectdojo-media:/app/media
42+
43+
celerybeat:
44+
image: defectdojo/defectdojo-django:latest
45+
depends_on:
46+
- mysql
47+
- rabbitmq
48+
environment:
49+
DD_DATABASE_URL: mysql://defectdojo:defectdojo@mysql:3306/defectdojo
50+
DD_CELERY_BROKER_URL: amqp://defectdojo:defectdojo@rabbitmq:5672/
51+
DD_ADMIN_USER: admin
52+
DD_ADMIN_PASSWORD: admin
53+
DD_ADMIN_MAIL: admin@localhost
54+
DD_ALLOWED_HOSTS: "*"
55+
restart: always
56+
entrypoint: ['/entrypoint-celery-beat.sh']
57+
58+
celeryworker:
59+
image: defectdojo/defectdojo-django:latest
60+
depends_on:
61+
- mysql
62+
- rabbitmq
63+
environment:
64+
DD_DATABASE_URL: mysql://defectdojo:defectdojo@mysql:3306/defectdojo
65+
DD_CELERY_BROKER_URL: amqp://defectdojo:defectdojo@rabbitmq:5672/
66+
DD_ADMIN_USER: admin
67+
DD_ADMIN_PASSWORD: admin
68+
DD_ADMIN_MAIL: admin@localhost
69+
DD_ALLOWED_HOSTS: "*"
70+
restart: always
71+
entrypoint: ['/entrypoint-celery-worker.sh']
72+
73+
volumes:
74+
defectdojo-mysql-data:
75+
defectdojo-rabbitmq-data:
76+
defectdojo-media:

0 commit comments

Comments
 (0)