GitLab Incubation Engineering, 11 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Incubation Engineering - Breach and Attack Simulation - Weekly update 2023-01-11

Description

Hi y'all it's Erran Carey back with a weekly update of Breach and Attack Simulation (BAS) Single-Engineer Group.

This week we're back with a custom DAST scanner which wraps the open source nuclei with a tool which converts the output into the DAST report format.

https://gitlab.com/gitlab-org/incubation-engineering/breach-and-attack-simulation/meta/-/issues/1#note_1230610530

A

Hey y'all, I'm erran carey and I'm back for another incubation.

A

Engineering breach and attack simulation single-engineer group, weekly update.

A

So over the holidays and sort-of coming up into the new year, what I've been focused on is creating.

A

A custom dast analyzer to extend it [dast] with more attacker and active check. Capabilities.

A

What I've gone ahead and done here is..., I prerecorded a demo video which I'll walk through.

A

Which will show a little bit about the structure, running this in gitlab.com already.

A

So if we go here, one of the things we can do inside the gitlab ci job is create a dast job.

A

In your pipeline that dast job can be running in whichever image you choose., I've used docker.

A

So I can run custom, docker images using docker-in-docker and then I've run a.

A

Vulnerable service container called damn vulnerable web app.

A

(Dvwa). we can see here that I used docker run to run my custom nuclei-analyzer container.

A

And then I output the result of that as a gitlab dast report format, json.

A

So [that], what I do here is I essentially wrap nuclei with my.

A

Custom analyzer, which converts it from the nuclei jsonl[ine] results into the.

A

Security report format that's actually ingested into the gitlab.com pipeline.

A

Any code or making any mrs against the gitlab-com.

A

Source code, because I'm able to use just the open source format- that's already supported.

A

We can see here if I drill into the actual docker [image] repository where I build.

A

This docker image we can see here it's [just], a little golang project, which takes the input from.

A

The jsonl[ines] format and then it converts it into the gitlab security report, format.

A

We can see here that it's pushed to the gitlab container registry.. We have the.

A

Image available to us and if we drill into the job where this is built, we can see that.

A

I'm using docker and I cross-compile it so it runs on m1 mac or just a normal 64-bit system..

A

That wraps up that, and just besides that I have been continuing to post my regular text, updates.

A

You can see here on january 6th, I just posted a little bit.. I talked about how I've updated.

A

The handbook page for breach and attack simulation- and this talks a lot more about the scope in terms.

A

Of what we'd like to attempt to simulate attacks on, as well as the feature sets that are relating.

A

To this, and a lot of them are very naturally relating to existing stuff. We have in the product.

A

Thanks again and hope to see y'all soon., if there's any comments or anything, please.

A

Feel free to comment on the video or just drop a note in the meta issue.

A

Where I'll track that. look forward to hearing from y'all, see you.