Enabling Gitlab DAST for Dynamic Application Security Testing
Learn how to enable Gitlab's Dynamic Application Security Testing (DAST) to test applications for vulnerabilities, using OWASP Zed Attack Proxy (ZAP) and different scanning modes. Understand the process from environment creation to specific configurations for Passive and Active testing modes.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Enabling Gitlab to use DAST to test NBI Eduardo Sousa, Mark Beierl (Canonical)
What is DAST? Dynamic Application Security Testing (DAST) examines applications for vulnerabilities in deployed applications. Vulnerabilities might range from misconfiguration of the web server to incorrect assumptions made about the code. Gitlab uses a widely known and used tool: OWASP Zed Attack Proxy (ZAP)
DAST Modes in Gitlab Passive scan - Gitlab executes a Baseline Scan with predefined tests. It doesn t attack the application. Passive and Active scan - It scans OSM and tries to actively attack it. Can be configured to be more complete and thorough.
Objective 1. Enable DAST in Gitlab in the Passive mode for NBI and NG-UI 2. Analyze the results 3. Create specific configurations for both components to perform the tests in Passive and Active mode
Specific Steps Creation of environment where OSM can be deployed (CD) Decouple execution of tests from OSM deployment Creation of a DAST job to test the deployed OSM By IP address, or specific hostname in Ingress
