1

I had been tasked with automating application api security testing for proof of concept project which requires me to propose a tool. Now this tool has to provide data results as json/xml or otherwise in order for Jenkins to consume & graffna to combine all the data for an integrated dashboard which includes performance validation, functional validation & as well as security validation.

So far, I was able to figure out few api security tools which could support with validation tasks however these weren't a bridge to jenkins for the devops team to utilize. These tools were Astra, Vooki, syntribos & Susanoo

I would like to receive support on this if few of you folks might be open to share feedbacks on the situation & the tooling to be proposed.

Improve this question
2
  • First, figure out how to run the tools from the command line. Then, set up a Jenkins task that runs the tool. You'll need some way to determine if a run is a pass or fail, probably by grepping the output and passing a suitable status code back to Jenkins. If that's too much scripting for you, you'll need to find a tool that has Jenkins integration. I'm not sure if any open sources ones exist, although there are some commercial.
    – paj28
    Apr 16, 2019 at 12:27
  • Aware about the commerecial ones - IBM Appscan & Fortify SCA/Webinpsect to be specific ones. However, opensource is the requirement. Plus, that'd be way much for the automation to be done from scripting perspective. Plenty of command line interfaces are available for DAST security scans however, for API specific, looks like a blocker. Lets see if we can have few more answers around this.
    – Shritam Bhowmick
    Apr 16, 2019 at 12:51

2 Answers 2

Reset to default
1

Try OWASP ZAP API Scan. There's a lot of information about this tool and it's integration with CI/CD pipelines. You can provide OpenAPI definitions to scanner, solve authentication issues using tokens and collect results in json format.

This is the url of the official project: https://github.com/zaproxy/zaproxy/wiki/ZAP-API-Scan

Improve this answer
0

I think you need to make by your self the tool. Bear in mind that APIs can be designed with different things on mind. Some of them can be based on encoding information on URIs (in the case of HTTP), others are binaries protocols that require understanding of the protocol. Also some APIs require what I call "Tokens" that are keys or cryptography keys that goes embedded on the HTTP Requests and you need to know the name of the Token on the API in order to make cryptographic attacks to them. My recommendation is to build your own tool specially if the API is proprietary.

Hope it helps

Improve this answer
1
  • You meant to reframe a tool as per the requirement? I was looking forward to a tool which could be readily be in use (which could be open source). I had been documenting this since it isn't possible for me to write a tool as my entire background has ben security testing rather than the devops. Plus, I can verify that these frameworks are very much possible as they've had done with IBm Appscan, Fortify SCA, Fortify WebInspect, etc. Given that it's doable, I am looking for opensource solutions. It's not possible to write a whole seperate tool & it shall spawn another dev operation overall..
    – Shritam Bhowmick
    Apr 16, 2019 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .