GITBOOK-479: No subject

Author: Whitespots

SUMMARY.md

@@ -96,7 +96,7 @@
     * [Web Scanners](appsec-portal/scanners/scanner-description/web-scanners/README.md)
       * [Arachni Scan](appsec-portal/scanners/scanner-description/web-scanners/arachni-scan.md)
       * [Acunetix](appsec-portal/scanners/scanner-description/web-scanners/acunetix.md)
-      * [BurpSuit Enterprise](appsec-portal/scanners/scanner-description/web-scanners/burpsuit-enterprise.md)
+      * [Burp Enterprise Scan](appsec-portal/scanners/scanner-description/web-scanners/burp-enterprise-scan.md)
       * [OWASP Zap](appsec-portal/scanners/scanner-description/web-scanners/owasp-zap.md)
     * [Infrastructure Scanners](appsec-portal/scanners/scanner-description/infrastructure-scanners/README.md)
       * [AWS Security Hub Scan](appsec-portal/scanners/scanner-description/infrastructure-scanners/aws-security-hub-scan/README.md)

appsec-portal/scanners/README.md

@@ -41,7 +41,7 @@ Here are the details of each **importer** supported by AppSec Portal
 
 * **`Arachni`**: imports scan results from [**Arachni Scanner**](scanner-description/web-scanners/arachni-scan.md), which is a tool for scanning modern web applications for a variety of vulnerabilities including SQL injection, cross-site scripting, file inclusion, and more.
 * **`Acunetix`** : imports scan results from [**Acunetix**](scanner-description/web-scanners/acunetix.md), a scanner designed to detect vulnerabilities in web applications.
-* **`Burpsuit`**: imports scan results from [**BurpSuit Enterprise scanner**](scanner-description/web-scanners/burpsuit-enterprise.md), which is a tool for automated web application security testing and vulnerability scanning.
+* **`Burpsuit`**: imports scan results from [**BurpSuit Enterprise scanner**](scanner-description/web-scanners/burp-enterprise-scan.md), which is a tool for automated web application security testing and vulnerability scanning.
 * **`OWASP Zap`**: is responsible for importing scan results from [**GitLab** **OWASP Zap Scanner**](scanner-description/web-scanners/owasp-zap.md), wich is a security testing tool focused on web application vulnerabilities, including SQL injection, cross-site scripting (XSS), and more.
 
 **Mobile Scanners:**

appsec-portal/scanners/scanner-description/web-scanners/acunetix.md

@@ -6,6 +6,27 @@ description: >-
 
 # Acunetix
 
+**AppSec Portal Importer Name**: Acunetix Scan
+
 [Acunetix](https://www.acunetix.com/) is a specialized scanner designed to detect **vulnerabilities** in **web applications**. It provides a comprehensive solution for identifying security issues that could potentially compromise the security of web applications.
 
 Acunetix scans web applications by performing a thorough examination of their code, configuration, and functionality. It is equipped to discover a wide range of security vulnerabilities, including but not limited to SQL injection, cross-site scripting (XSS), security misconfigurations, and more. This extensive coverage ensures that web application developers and security professionals can identify and address potential threats effectively.
+
+#### Curl example
+
+{% code overflow="wrap" %}
+```
+curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./acunetix.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name= Acunetix Scan" -F "branch=dev" 
+```
+{% endcode %}
+
+In this command, the following parameters are used:
+
+1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
+2. `-H "Authorization: Token <authorization_token>"`: specifies the [**authorization token**](../../importing-reports-from-scanners-to-appsec-portal/#authorization-token) obtained from AppSec Portal.
+3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
+4. `-F "file=@<report_file_path>"`: specifies the **path to the report file** generated by the scanner.
+5. `-F "product_name=<product_name>"`: specifies the **name of the product** being scanned.
+6. `-F "product_type=<product_type>"`: specifies the **type of the product** being scanned.
+7. `-F "scanner_name=<scanner_name>"`: specifies the **name of the scanner** used to generate the report (Bandit Scan or GitLab Bandit)
+8. `-F "branch=<branch_name>"`: (_optional_) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

appsec-portal/scanners/scanner-description/web-scanners/arachni-scan.md

@@ -6,6 +6,36 @@ description: >-
 
 # Arachni Scan
 
+**Auditor Job Name**: Arachni\
+**Auditor image:** registry.gitlab.com/whitespots-public/security-images/arachni:1.5.1\
+**AppSec Portal Importer Name**: Arachni Scan
+
 It utilizes a combination of black-box scanning techniques and a comprehensive set of built-in checks to assess the security posture of web applications.
 
-One of the notable features of Arachni is its ability to crawl and scan web applications in a way that **mimics the behavior of a real user**. This allows the scanner to detect vulnerabilities that would not be visible through a standard scan. Arachni also has the ability to identify vulnerabilities in various technologies and programming languages including **PHP**, **Ruby on Rails**, and **Java**.
+One of the notable features of [Arachni](https://github.com/Arachni/arachni) is its ability to crawl and scan web applications in a way that **mimics the behavior of a real user**. This allows the scanner to detect vulnerabilities that would not be visible through a standard scan. Arachni also has the ability to identify vulnerabilities in various technologies and programming languages including **PHP**, **Ruby on Rails**, and **Java**.
+
+#### Curl example
+
+{% code overflow="wrap" %}
+```
+curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./arachni.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Arachni Scan" -F "branch=dev" -F "domain=whitespots.io"
+```
+{% endcode %}
+
+In this command, the following parameters are used:
+
+1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
+2. `-H "Authorization: Token <authorization_token>"`: specifies the [**authorization token**](../../importing-reports-from-scanners-to-appsec-portal/#authorization-token) obtained from AppSec Portal.
+3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
+4. `-F "file=@<report_file_path>"`: specifies the **path to the report file** generated by the scanner.
+5. `-F "product_name=<product_name>"`: specifies the **name of the product** being scanned.
+6. `-F "product_type=<product_type>"`: specifies the **type of the product** being scanned.
+7. `-F "scanner_name=<scanner_name>"`: specifies the **name of the scanner** used to generate the report (Arachni Scan)
+8. `-F "branch=<branch_name>"`: (_optional_) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch
+
+Asset information, if an [auditor ](broken-reference)is used
+
+9. `-F "repository=<repository SSH URL>"`: If your product is **code** in a repository enter the address of your **repository** in a specific format, for example: git@gitlab.com:whitespots-public/appsec-portal.git
+10. &#x20;\-F "docker\_image=\<registry address>": If your product is **image** enter the address of the **registry** where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto\_validator:latest
+11. \-F "domain=\<domain>": If your product is **web** enter the **domain name** of your product, for example: whitespots.io
+12. \-F "host=\<host>": If your product is **web** enter the **IP address** of your product, for example: 0.0.0.0

appsec-portal/scanners/scanner-description/web-scanners/burp-enterprise-scan.md

@@ -0,0 +1,32 @@
+---
+description: >-
+  BurpSuite Enterprise is a web vulnerability scanner that is designed for
+  enterprise-level web application security testing.
+---
+
+# Burp Enterprise Scan
+
+**AppSec Portal Importer Name**: Burp Enterprise Scan
+
+It is a scalable solution that allows security teams to conduct efficient and comprehensive security assessments of their **web applications**.
+
+BurpSuite Enterprise offers a wide range of automated scanning capabilities, including the ability to perform advanced scans on _complex_ web applications and identify vulnerabilities such as **SQL injection**, **cross-site scripting (XSS)**, and **authentication bypass**. The scanner also includes a variety of customization options, allowing users to configure the scanner according to their specific testing requirements.
+
+#### Curl example
+
+{% code overflow="wrap" %}
+```
+curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./bis.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Burp Enterprise Scan" -F "branch=dev" 
+```
+{% endcode %}
+
+In this command, the following parameters are used:
+
+1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
+2. `-H "Authorization: Token <authorization_token>"`: specifies the [**authorization token**](../../importing-reports-from-scanners-to-appsec-portal/#authorization-token) obtained from AppSec Portal.
+3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
+4. `-F "file=@<report_file_path>"`: specifies the **path to the report file** generated by the scanner.
+5. `-F "product_name=<product_name>"`: specifies the **name of the product** being scanned.
+6. `-F "product_type=<product_type>"`: specifies the **type of the product** being scanned.
+7. `-F "scanner_name=<scanner_name>"`: specifies the **name of the scanner** used to generate the report (Bandit Scan or GitLab Bandit)
+8. `-F "branch=<branch_name>"`: (_optional_) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

appsec-portal/scanners/scanner-description/web-scanners/burpsuit-enterprise.md

@@ -4,4 +4,25 @@ description: This helps you discover vulnerabilities in web applications
 
 # OWASP Zap
 
+**AppSec Portal Importer Name**: GitLab OWASP Zap
+
 [GitLab OWASP Zap](https://docs.gitlab.com/ee/user/application\_security/dast/proxy-based.html) is a penetration testing and vulnerability detection tool for **web applications**. It offers capabilities to scan web applications for vulnerabilities like **SQL injection**, **cross-site scripting (XSS)**, and more. OWASP Zap helps developers explore web application security and safeguard against known attacks.
+
+#### Curl example
+
+{% code overflow="wrap" %}
+```
+curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./gl-dast-report.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=GitLab OWASP Zap" -F "branch=dev" 
+```
+{% endcode %}
+
+In this command, the following parameters are used:
+
+1. `-X POST`: specifies the HTTP method to be used (in this case, POST)
+2. `-H "Authorization: Token <authorization_token>"`: specifies the [**authorization token**](../../importing-reports-from-scanners-to-appsec-portal/#authorization-token) obtained from AppSec Portal.
+3. `-H "Content-Type: multipart/form-data"`: specifies the content type of the request.
+4. `-F "file=@<report_file_path>"`: specifies the **path to the report file** generated by the scanner.
+5. `-F "product_name=<product_name>"`: specifies the **name of the product** being scanned.
+6. `-F "product_type=<product_type>"`: specifies the **type of the product** being scanned.
+7. `-F "scanner_name=<scanner_name>"`: specifies the **name of the scanner** used to generate the report (GitLab OWASP Zap)
+8. `-F "branch=<branch_name>"`: (_optional_) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch