diff --git a/.brightsec/tests/delete-logout.test.ts b/.brightsec/tests/delete-logout.test.ts new file mode 100644 index 0000000..d8a9ccb --- /dev/null +++ b/.brightsec/tests/delete-logout.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('DELETE /logout', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'http_method_fuzzing'], + attackParamLocations: [AttackParamLocation.HEADER], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.DELETE, + url: `${baseUrl}/logout` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/delete-posts-1.test.ts b/.brightsec/tests/delete-posts-1.test.ts new file mode 100644 index 0000000..35b2726 --- /dev/null +++ b/.brightsec/tests/delete-posts-1.test.ts @@ -0,0 +1,39 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('DELETE /posts/1', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'bopla', 'id_enumeration', 'sqli'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.DELETE, + url: `${baseUrl}/posts/1`, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/delete-users-1-json.test.ts b/.brightsec/tests/delete-users-1-json.test.ts new file mode 100644 index 0000000..3c1f9f1 --- /dev/null +++ b/.brightsec/tests/delete-users-1-json.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('DELETE /users/1.json', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'bopla', 'id_enumeration', 'sqli'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.DELETE, + url: `${baseUrl}/users/1.json` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/delete-users-1.test.ts b/.brightsec/tests/delete-users-1.test.ts new file mode 100644 index 0000000..dd8e3b8 --- /dev/null +++ b/.brightsec/tests/delete-users-1.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('DELETE /users/1', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'bopla', 'id_enumeration', 'sqli'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.DELETE, + url: `${baseUrl}/users/1` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-login.test.ts b/.brightsec/tests/get-login.test.ts new file mode 100644 index 0000000..6781e7b --- /dev/null +++ b/.brightsec/tests/get-login.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /login', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'xss', 'sqli', 'unvalidated_redirect', 'secret_tokens'], + attackParamLocations: [AttackParamLocation.QUERY, AttackParamLocation.HEADER], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/login` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-posts-1-edit.test.ts b/.brightsec/tests/get-posts-1-edit.test.ts new file mode 100644 index 0000000..f8d0c9b --- /dev/null +++ b/.brightsec/tests/get-posts-1-edit.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /posts/1/edit', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'bopla', 'id_enumeration', 'xss'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/posts/1/edit` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-posts-1.test.ts b/.brightsec/tests/get-posts-1.test.ts new file mode 100644 index 0000000..95b89ac --- /dev/null +++ b/.brightsec/tests/get-posts-1.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /posts/1', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'id_enumeration', 'sqli', 'xss'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/posts/1` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-posts-new.test.ts b/.brightsec/tests/get-posts-new.test.ts new file mode 100644 index 0000000..9d9c567 --- /dev/null +++ b/.brightsec/tests/get-posts-new.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /posts/new', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'xss', 'bopla'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/posts/new` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-posts-search.test.ts b/.brightsec/tests/get-posts-search.test.ts new file mode 100644 index 0000000..3a36d5f --- /dev/null +++ b/.brightsec/tests/get-posts-search.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /posts/search?search_term=example', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['sqli', 'xss', 'csrf', 'business_constraint_bypass'], + attackParamLocations: [AttackParamLocation.QUERY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/posts/search?search_term=example` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-posts.test.ts b/.brightsec/tests/get-posts.test.ts new file mode 100644 index 0000000..f329ab4 --- /dev/null +++ b/.brightsec/tests/get-posts.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /posts', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['sqli', 'csrf', 'xss', 'id_enumeration', 'business_constraint_bypass'], + attackParamLocations: [AttackParamLocation.QUERY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/posts` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-users-1-edit.test.ts b/.brightsec/tests/get-users-1-edit.test.ts new file mode 100644 index 0000000..ff15698 --- /dev/null +++ b/.brightsec/tests/get-users-1-edit.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /users/1/edit', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'id_enumeration', 'xss', 'bopla'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/users/1/edit` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-users-1-json.test.ts b/.brightsec/tests/get-users-1-json.test.ts new file mode 100644 index 0000000..fdf19ff --- /dev/null +++ b/.brightsec/tests/get-users-1-json.test.ts @@ -0,0 +1,39 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /users/1.json', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['id_enumeration', 'bopla', 'sqli', 'xss'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/users/1.json`, + headers: { 'Accept': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-users-1-posts.test.ts b/.brightsec/tests/get-users-1-posts.test.ts new file mode 100644 index 0000000..0e44111 --- /dev/null +++ b/.brightsec/tests/get-users-1-posts.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /users/1/posts', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['sqli', 'bopla', 'id_enumeration', 'xss'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/users/1/posts` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-users-1.test.ts b/.brightsec/tests/get-users-1.test.ts new file mode 100644 index 0000000..b277547 --- /dev/null +++ b/.brightsec/tests/get-users-1.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /users/1', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['id_enumeration', 'bopla', 'sqli', 'xss'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/users/1` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-users-json.test.ts b/.brightsec/tests/get-users-json.test.ts new file mode 100644 index 0000000..aad7ae7 --- /dev/null +++ b/.brightsec/tests/get-users-json.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /users.json', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'id_enumeration', 'xss', 'bopla', 'business_constraint_bypass'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/users.json` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-users-new.test.ts b/.brightsec/tests/get-users-new.test.ts new file mode 100644 index 0000000..9dd1811 --- /dev/null +++ b/.brightsec/tests/get-users-new.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /users/new', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'xss', 'html_injection', 'id_enumeration'], + attackParamLocations: [AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/users/new` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/get-users.test.ts b/.brightsec/tests/get-users.test.ts new file mode 100644 index 0000000..bb44836 --- /dev/null +++ b/.brightsec/tests/get-users.test.ts @@ -0,0 +1,38 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('GET /users', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'id_enumeration', 'xss', 'bopla', 'business_constraint_bypass'], + attackParamLocations: [AttackParamLocation.QUERY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.GET, + url: `${baseUrl}/users` + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/patch-posts-1.test.ts b/.brightsec/tests/patch-posts-1.test.ts new file mode 100644 index 0000000..8efba5c --- /dev/null +++ b/.brightsec/tests/patch-posts-1.test.ts @@ -0,0 +1,44 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('PATCH /posts/1', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'bopla', 'xss', 'sqli', 'id_enumeration'], + attackParamLocations: [AttackParamLocation.BODY, AttackParamLocation.HEADER], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.PATCH, + url: `${baseUrl}/posts/1`, + body: { + title: 'Updated Title', + content: 'Updated content of the post.', + public: true + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/patch-users-1-json.test.ts b/.brightsec/tests/patch-users-1-json.test.ts new file mode 100644 index 0000000..8250470 --- /dev/null +++ b/.brightsec/tests/patch-users-1-json.test.ts @@ -0,0 +1,47 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('PATCH /users/1.json', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['bopla', 'csrf', 'xss', 'sqli', 'unvalidated_redirect'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.PATCH, + url: `${baseUrl}/users/1.json`, + body: { + user: { + email: 'example@example.com', + password: 'securepassword', + password_digest: '$2a$12$KIXQ1Y1u1b1J1J1J1J1J1O', + admin: false + } + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/patch-users-1.test.ts b/.brightsec/tests/patch-users-1.test.ts new file mode 100644 index 0000000..59abf32 --- /dev/null +++ b/.brightsec/tests/patch-users-1.test.ts @@ -0,0 +1,47 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('PATCH /users/1', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'bopla', 'xss', 'sqli', 'osi', 'secret_tokens'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.PATCH, + url: `${baseUrl}/users/1`, + body: { + user: { + email: 'newemail@example.com', + password: 'newpassword', + password_digest: 'newpassworddigest', + admin: false + } + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/patch-users-123.test.ts b/.brightsec/tests/patch-users-123.test.ts new file mode 100644 index 0000000..63f1f4b --- /dev/null +++ b/.brightsec/tests/patch-users-123.test.ts @@ -0,0 +1,45 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('PATCH /users/123', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['bopla', 'csrf', 'sqli', 'xss', 'id_enumeration'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.PATCH, + url: `${baseUrl}/users/123`, + body: { + email: 'newemail@example.com', + password: 'newpassword', + password_digest: 'newpassworddigest', + admin: false + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/post-login.test.ts b/.brightsec/tests/post-login.test.ts new file mode 100644 index 0000000..306e090 --- /dev/null +++ b/.brightsec/tests/post-login.test.ts @@ -0,0 +1,43 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('POST /login', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'sqli', 'xss', 'html_injection', 'email_injection', 'unvalidated_redirect'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.POST, + url: `${baseUrl}/login`, + body: { + email: 'user@example.com', + password: 'securepassword' + }, + headers: { 'Content-Type': 'application/x-www-form-urlencoded' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/post-posts.test.ts b/.brightsec/tests/post-posts.test.ts new file mode 100644 index 0000000..3d3e9dd --- /dev/null +++ b/.brightsec/tests/post-posts.test.ts @@ -0,0 +1,44 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('POST /posts', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'xss', 'sqli', 'bopla', 'osi'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.POST, + url: `${baseUrl}/posts`, + body: { + title: 'Sample Post Title', + content: 'This is a sample post content.', + public: true + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/post-users-123-posts.test.ts b/.brightsec/tests/post-users-123-posts.test.ts new file mode 100644 index 0000000..8a72fb5 --- /dev/null +++ b/.brightsec/tests/post-users-123-posts.test.ts @@ -0,0 +1,44 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('POST /users/123/posts', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'sqli', 'xss', 'bopla', 'id_enumeration'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.POST, + url: `${baseUrl}/users/123/posts`, + body: { + title: 'Sample Post Title', + content: 'This is a sample post content.', + public: true + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/post-users-json.test.ts b/.brightsec/tests/post-users-json.test.ts new file mode 100644 index 0000000..5ec774b --- /dev/null +++ b/.brightsec/tests/post-users-json.test.ts @@ -0,0 +1,47 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('POST /users.json', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'bopla', 'sqli', 'xss', 'email_injection'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.POST, + url: `${baseUrl}/users.json`, + body: { + user: { + email: 'example@example.com', + password: 'password123', + password_digest: '$2a$12$KIXQ1Y1l1F1F1F1F1F1F1O', + admin: false + } + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/post-users.test.ts b/.brightsec/tests/post-users.test.ts new file mode 100644 index 0000000..0dfc0be --- /dev/null +++ b/.brightsec/tests/post-users.test.ts @@ -0,0 +1,45 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('POST /users', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'xss', 'sqli', 'bopla', 'secret_tokens'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.POST, + url: `${baseUrl}/users`, + body: { + email: 'example@example.com', + password: 'password123', + password_digest: '$2a$12$KIXQ1Y1l1F1', + admin: false + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/put-posts-1.test.ts b/.brightsec/tests/put-posts-1.test.ts new file mode 100644 index 0000000..880a524 --- /dev/null +++ b/.brightsec/tests/put-posts-1.test.ts @@ -0,0 +1,44 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('PUT /posts/1', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'bopla', 'sqli', 'xss', 'id_enumeration'], + attackParamLocations: [AttackParamLocation.BODY, AttackParamLocation.PATH], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.PUT, + url: `${baseUrl}/posts/1`, + body: { + title: 'Updated Post Title', + content: 'Updated content of the post.', + public: true + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/put-users-1-json.test.ts b/.brightsec/tests/put-users-1-json.test.ts new file mode 100644 index 0000000..560efa8 --- /dev/null +++ b/.brightsec/tests/put-users-1-json.test.ts @@ -0,0 +1,45 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('PUT /users/1.json', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['bopla', 'csrf', 'sqli', 'xss'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.PUT, + url: `${baseUrl}/users/1.json`, + body: { + email: 'user@example.com', + password: 'securepassword', + password_digest: '$2a$12$KIXQ1Y1I1', + admin: false + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/put-users-1.test.ts b/.brightsec/tests/put-users-1.test.ts new file mode 100644 index 0000000..9fbd323 --- /dev/null +++ b/.brightsec/tests/put-users-1.test.ts @@ -0,0 +1,47 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('PUT /users/1', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['csrf', 'bopla', 'sqli', 'xss', 'id_enumeration', 'osi'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.PUT, + url: `${baseUrl}/users/1`, + body: { + user: { + email: 'user@example.com', + password: 'securePassword123', + password_digest: '$2a$12$KIXQ1Y1l1F1', + admin: false + } + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file diff --git a/.brightsec/tests/put-users-123.test.ts b/.brightsec/tests/put-users-123.test.ts new file mode 100644 index 0000000..66ff857 --- /dev/null +++ b/.brightsec/tests/put-users-123.test.ts @@ -0,0 +1,45 @@ +import { test, before, after } from 'node:test'; +import { SecRunner } from '@sectester/runner'; +import { AttackParamLocation, HttpMethod } from '@sectester/scan'; + +const timeout = 40 * 60 * 1000; +const baseUrl = process.env.BRIGHT_TARGET_URL!; + +let runner!: SecRunner; + +before(async () => { + runner = new SecRunner({ + hostname: process.env.BRIGHT_HOSTNAME!, + projectId: process.env.BRIGHT_PROJECT_ID! + }); + + await runner.init(); +}); + +after(() => runner.clear()); + +test('PUT /users/123', { signal: AbortSignal.timeout(timeout) }, async () => { + await runner + .createScan({ + tests: ['bopla', 'csrf', 'sqli', 'xss', 'id_enumeration'], + attackParamLocations: [AttackParamLocation.BODY], + starMetadata: { + code_source: 'tssbox/ruby-example-app:master', + databases: ['PostgreSQL'], + user_roles: ['admin'] + } + }) + .setFailFast(false) + .timeout(timeout) + .run({ + method: HttpMethod.PUT, + url: `${baseUrl}/users/123`, + body: { + email: 'user@example.com', + password: 'securepassword', + password_digest: '$2a$12$KIXQ1Y1l1F1', + admin: false + }, + headers: { 'Content-Type': 'application/json' } + }); +}); \ No newline at end of file