Projects:Continuous security testing
| Description | I do a lot of things a whole lot, so why not automate these things? What thing? Things like portscans, masscans, vulnscans, bruteforces, sqlmaps, etc... |
|---|---|
| Language | |
| Has website | |
| Organized by | |
| Persons working on | C |
| Tags | Assembly:HSBE, Pentesting, CI, Docker, Angular, Python |
| Located at assembly | Assembly:HSBE |
| Other projects... ... further results | |
(Click here to refresh this page.)
I work as a freelance pentester and I see myself doing some things a lot, things like portscans, nikto-scans, etc... These take up alot of waiting time and it's easy to forget a few of these basic checks when starting on a new project, possibly missing crucial information while it was right there in front of your eyes the whole time, you just had to look.
So, I started working on this project which allows me to automate a whole bunch of those tasks. I've tried a few things before and restarted a few times, but this time I think I might have it just right.
The basic idea is the following:
- A webapplication which allows the user to create "projects"
- In a project, this user then get's a dashboard where he or she can then do the following
- Add things like domains, ip-addressess or url's to the scope
- Run or schedule tests
- Consult testresults and stats
No big problem right? Until you start thinking it through: how are you going to schedule tasks for repeated execution in a schedule? Suppose you use CRON for this, then what code should CRON execute at the given interval? This is no trivial problem to solve I've experienced. First of course I just coded everything right into my app using threading, which was not a very smart idea and landed in a dead end. Next, I looked into using a manager/worker setup using Celery. This seemed to be working, it was for sure the right paradigm to follow, but the execution was very buggy and I couldn't get the Celery manager and workers to do exactly what I wanted. So there I was, having a great idea, knowing that it can be done, but lacking the technical knowledge to complete the challenge. So I let the project rest for some months, while trying to figure out a solution for the distribution of work to worker-instances.
The solution came to me some months ago when I started looking into the workings of Docker and learned how to containerize applications. This was the solution to my problem! I could put each of the applications that I often use during pentests into seperate container images and then just run those as containers and pass parameters to them.
So basically that's my project:
- A webapp build in Angular that serves as Front-end to
- An API that allows for the orchestration of various pentesting tools using docker containers
Currently I'm still working on version 0 so I haven't got any code out in the open yet, but I'll probably open it up at Congress.
