Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Write readme and document getting started guide #13

Open
preetkaran20 opened this issue Apr 30, 2021 · 18 comments
Open

Write readme and document getting started guide #13

preetkaran20 opened this issue Apr 30, 2021 · 18 comments
Labels
documentation Improvements or additions to documentation enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed

Comments

@preetkaran20
Copy link
Member

While discussing with @nowakkamil found that we are missing readme details and documentation so need to add it.
@preetkaran20 preetkaran20 added documentation Improvements or additions to documentation enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed labels Apr 30, 2021
@preetkaran20
Copy link
Member Author

updated the readme file, however need to update the contributing guideline.

@preetkaran20
Copy link
Member Author

Update the Readme of this project and also https://owasp.org/www-project-vulnerableapp-facade/ which has github repository: https://github.com/OWASP/www-project-vulnerableapp-facade as they both point to old docker image.

@preetkaran20
Copy link
Member Author

Update the Readme of this project and also https://owasp.org/www-project-vulnerableapp-facade/ which has github repository: https://github.com/OWASP/www-project-vulnerableapp-facade as they both point to old docker image.

Updated the docker image links.

@preetkaran20
Copy link
Member Author

Left items in this task:

  1. Creating a document explaining how to onboard a vulnerable application to the VulnerableApp-facade project.
  2. A new file explaining, how to contribute to the project. This is needed as we are building the UI in react and might require some explanation regarding coding structure.
  3. Update readme with the project's tech stack.
  4. Update https://owasp.org/www-project-vulnerable-web-applications-directory/ project.

@preetkaran20 preetkaran20 mentioned this issue Jul 4, 2021
Closed
@lmcdo
Copy link

lmcdo commented Jun 6, 2022

Hi, I can help with this. Can you tell me where I can find whatever information is required to do this documentation?

@preetkaran20
Copy link
Member Author

Hi @lmcdo ,

Some of the documentations links which are very uptodate:

  1. Readme for this project
  2. Owasp Spotlight into
  3. Our thoughts

Older references but still hold good information:

  1. Older video explaining about initial project
  2. Older documentation
  3. Design document
  4. Blog
  5. https://github.com/SasanLabs/VulnerableApp-jsp and https://github.com/SasanLabs/VulnerableApp-php depicting how any vulnerable application can leverage the VulnerableApp-facade.

Please let me know if you need more context, we can discuss over a call.

thanks,
Karan

@lmcdo
Copy link

lmcdo commented Jun 7, 2022 via email

@preetkaran20
Copy link
Member Author

Hi @lmcdo,

On pointer 1, the way we configure a vulnerable app is via a json contract and you can find the contract details in https://github.com/SasanLabs/VulnerableApp-facade/wiki/Contract-Schema-Design-for-Vulnerable-Applications-to-register-to-VulnerableApp-facade. Also you can look into https://github.com/SasanLabs/VulnerableApp-facade/blob/main/nginx.conf and https://github.com/SasanLabs/VulnerableApp-facade/blob/main/lua-modules/vulnerableapp_utility.lua on how we configured 3 vulnerable apps.

On pointer 2, I think current structure has issues in explaining the ways to debug/local setup, we need a document or a video explaining, how to configure or remove one app under the vulnerable app facade etc in order to just run the application as well as in order to develop or enhance it.

On pointer 3, we just need to tell about the react version we are using in readme as well as npm version. We can also include a video detail explaining how the entire architecture of application is build etc if possible.

Pointer 4, we can ignore.

Thanks,
Karan

@lmcdo
Copy link

lmcdo commented Jun 12, 2022 via email

@preetkaran20
Copy link
Member Author

Hi @lmcdo,

I think the best way to discuss all these points is over the call. I work in IST timezone till 10 PM IST, so let me know when can we connect? Happy to connect today as well.

thanks,
Karan

@lmcdo
Copy link

lmcdo commented Jun 12, 2022 via email

@preetkaran20
Copy link
Member Author

@lmcdo Sure works for me, please schedule a meeting on google meet. My email address is: [email protected]

thanks,
Karan

@lmcdo
Copy link

lmcdo commented Jun 12, 2022 via email

@lmcdo
Copy link

lmcdo commented Jun 15, 2022 via email

@preetkaran20
Copy link
Member Author

preetkaran20 commented Jun 18, 2022 •
edited
Loading

Hi @lmcdo ,

  1. I find I still don't have a clue as to the test scanner use case :(
    Downloading and running the Facade project is easy enough, and I see that
    docker compose downloads and gets the Vulnerable App, plus jsp and php
    versions, and then populates the UI. But how is this useful for "testing a
    test scanner" which you said was the purpose of this VulnerableApp Facade?
    How to use the Levels in this process? There is no clue in the
    documentation.

[Karan]
if you go to http://localhost/VulnerabilityDefinitions endpoint, you can see all the vulnerabilities present in the VulnerableApps. So scanners can run against the VulnerableApp and find vulnerabilities and then scanners can compare it with the response from http://localhost/VulnerabilityDefinitions endpoint and see if scanner has found the right vulnerabilities. Please have a look at video https://youtu.be/HRRTrnRgMjs?t=311. The link is from the time where i explain, how Scanners can use VulnerableApp.

  1. The end user (test scanner dev, security/testing student) will want to
    edit their own app vulnerabilities, but these files need to go in the
    docker container, and that is why the Readme currently says "make a copy of
    docker.compose.yml" in order to deploy the changes that the user makes to
    their own code. Should the onboarding document provide a description of the
    preferred docker process?

[Karan]
Yes, the newer app onboarding should build a docker and update the docker-compose.yml something like we did for our own vulnerable application.
Have a look at point 1 under https://github.com/SasanLabs/VulnerableApp#building-the-project for more information.

@lmcdo
Copy link

lmcdo commented Jun 20, 2022 via email

@preetkaran20
Copy link
Member Author

@lmcdo Thanks for all the inputs and hardwork you did for this task. Shall i unassign this task?

thanks,
Karan

@lmcdo
Copy link

lmcdo commented Jun 20, 2022 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
documentation Improvements or additions to documentation enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@lmcdo @preetkaran20