Skip to content

Draft: Scan only passed in URLs

Craig Smith requested to merge run_scan_on_list_of_urls_214120 into master

What does this MR do?

This MR adds the ability to disable the DAST spider and scan only URLs specified in the DAST_URLS environment variable.

To run a URL scan locally, checkout this branch, cd into the project and build DAST:

docker build -t dast .

Start a basic site:

invoke server.basicsite

Since we want a safe place for DAST to write it's log and reports to, create a new place to run DAST.

mkdir -p ~/dast_tmp/output
cd ~/dast_tmp

Run the scan which includes the env variable DAST_URLS, which defines the URLs DAST should scan.

docker run \
       --rm \
       --network host \
       -v "${PWD}":/output \
       --env DAST_URLS=http://localhost:8010,http://localhost:8010/page2.html \
       dast /analyze -d -t http://localhost:8010 >url_scan.log 2>&

Once DAST is complete you'll have the DAST json report gl-dast-report.json (which includes vuleranbilites and the list of URLs scanned), the log url_scan.log and the zap log zap.out.

What are the relevant issue numbers?

!214120

Does this MR meet the acceptance criteria?

Edited by Craig Smith

Merge request reports