2 Star 2 Fork 0

HuaweiCloudDeveloper / huaweicloud-VSS-API-jenkins-intergration-sample

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
Apache-2.0

项目介绍

本项目是华为云开发者团队利用华为VSS服务能力,基于Jenkins构建任务调用VSS服务API对Web网站进行漏洞扫描的实践,基于多种不同能力的漏洞扫描插件,模拟用户真实浏览场景,帮助用户发现网站潜在的安全隐患。

设计思想

本项目场景通过DevCloud流水线调用Jenkins构建任务,基于VSS服务对Web网站进行漏洞扫描的实践,通过Jenkins构建任务调用API集成VSS漏洞扫描能力,实现对网站恶意内容、潜在风险、网站安全漏洞的扫描,并可以提供详细的漏洞分析报告,针对不同类型的漏洞提供专业可靠的修复建议。

环境配置

1.创建ECS
购买并登录弹性云服务器ECS,具体操作步骤请参考购买并登录Linux弹性云服务器

2.JDK安装
yum install java-1.8.0-openjdk* -y

3.Jenkins安装
登录弹性云服务器ECS后,执行下面的命令安装和运行Jenkins环境。
wget https://mirrors.jenkins-ci.org/redhat/jenkins-2.332-1.1.noarch.rpm
yum -y install daemonize
rpm -ivh jenkins-2.332-1.1.noarch.rpm
service jenkins start

4.导入样例demo
下载样例demo,把下载的压缩包解压缩。
登录弹性云服务器ECS后,执行cd /var/lib/jenkins/jobs命令,进入jobs目录,把解压缩后的webvsstask文件夹放到当前路径下。

5.修改所属用户及所属组
登录弹性云服务器ECS后,执行下面的命令修改所属用户及所属组。
chgrp -R jenkins webvsstask
chown -R jenkins webvsstask

6.安装插件
Jenkins默认是英语语言,建议安装插件设置Jenkins的语言为中文。进入到Jenkins首页,单击"Manage Jenkins" > "Manage Plugins",单击"可选插件",搜索Locale plugin插件 ,搜索找到后,进行安装,安装后,重启Jenkins。

参数介绍

domain_name: IAM用户所属帐号名
user_name: IAM用户名
project_id: IAM用户所属帐号ID
project_name: IAM用户所属帐号的项目名称
password:IAM用户密码
domain_url: 被扫描的Web网站的域名
alias:被扫描的Web网站的域名的别名
auth_mode:认证方式
task_name: 扫描任务的名称
interval: 获取扫描结果请求间隔时间(单位是秒)

代码说明

1.获取IAM用户Token API。 输入图片说明

2.根据获取IAM用户Token接口返回值,获取Token,设置到xauthtoken.sh文件中。 输入图片说明

3.从xauthtoken.sh文件中获取token作为请求参数,调用创建域名资产 API,把接口返回值中的domain_id设置到文件domain_id.sh中。 输入图片说明

4.从xauthtoken.sh文件中获取token作为请求参数,调用认证域名资产 API,对域名资产进行认证。 输入图片说明

5.从xauthtoken.sh文件中获取token作为请求参数,调用创建扫描任务并启动 API,执行漏洞扫描任务。 输入图片说明

6.根据接口的返回值,获取任务ID,使用任务ID作为请求参数,调用获取扫描结果 API。 输入图片说明

7.设置查看漏洞扫描结果地址,地址中需要使用任务ID,域名ID,扫描任务的名称。 输入图片说明

使用注意事项

1.请在构建任务执行完成后,再重新执行构建任务。如果上一次的构建任务没有执行完成,请不要执行新的构建任务。

2.样例demo使用的是VSS服务的基础版本,基础版配额内仅支持Web网站漏洞扫描(域名个数:5个,扫描次数:5个域名每日总共可以扫描5次)是免费的。可以根据需要,选择不同规格的VSS服务,详细规格信息,请参考产品规格差异

3.样例demo在调用创建扫描任务并启动 API时,设置的请求参数,实现的是Web常规漏洞扫描和端口扫描的功能,如果VSS版本是专业版、高级版、企业版可以通过设置不同的参数,实现更多的扫描功能,更多扫描功能,请参考创建扫描任务并启动

参数配置

1.IAM用户所属帐号名
输入图片说明
或者
输入图片说明

2.IAM用户名
输入图片说明
或者
输入图片说明

3.IAM用户所属帐号的项目ID、项目名称
输入图片说明 项目ID获取方式参考链接

4.IAM用户密码
输入图片说明

5.被扫描的Web网站的域名
包含[http://]或者[https://]的网站域名。VSS是通过公网访问域名/IP地址进行扫描的,请确保该目标域名/IP地址能通过公网正常访问。

6.被扫描的Web网站的域名的别名
自定义的网站域名的别名,只能由字母,数字,下划线,中划线,中文组成。长度是(1~50)。

7.认证方式
可以设置的值有"file","auto","free"。
file,文件认证。
auto,一键认证。
free,免认证。选择此项默认已阅读并了解下述使用要求 使用须知: 1、您的账号已完成实名认证,且非受限账号。 2、您确认您已获得对扫描对象进行扫描的相关合法权利。 3、您确认您的扫描行为有合法合理目的,且符合适用的法律法规要求,不得利用本服务从事任何黑灰产等非法活动。 4、若您违反上述承诺,我们有权立即终止您对本服务的使用,并要求您对我们及相关第三方因此遭受的损失进行赔偿。
样例demo使用的资源符合一键认证的条件,使用的认证方式是一键认证方式。如果不能使用一键认证方式,建议使用免认证方式,即认证方式的参数设置为free。文件认证,目前需要在漏洞扫描服务的页面进行操作,有关认证方式的更多内容,请参考域名认证一键认证方式的要求如图:

8.扫描任务的名称
自定义的扫描任务的名称,只能由字母,数字,下划线,中划线,中文组成。长度是(1~50)。

9.获取扫描结果请求间隔时间(单位是秒)
调用获取扫描结果 API的间隔时间,建议设置为(10~60之间的整数)。

验证

1.进入到Jenkins首页,单击构建任务名,例如:"webvsstask",单击"Build with Parameters",按照参数配置,设置正确的参数,单击"开始构建"。
输入图片说明

2.在构建任务页面,单击构建任务的执行序号,单击页面左侧"控制台输出",通过构建任务的日志,查看构建执行情况。
输入图片说明

3.等待构建任务执行完成,查看构建结果,单击构建日志中查看漏洞扫描结果地址,查看漏洞扫描结果。
输入图片说明 输入图片说明

参考指南

华为漏洞扫描服务VSS参考文档
华为漏洞扫描服务VSS产品
华为漏洞扫描服务VSS开发指南

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

简介

华为漏洞扫描服务集Web漏洞扫描、操作系统漏洞扫描、资产及内容合规检测、安全配置基线检查、弱密码检测、开源合规及漏洞检查、移动应用安全检查七大核心功能为一体,自动发现网站或服务器在网络中的安全风险,为云上业务提供多维度的安全检测服务,满足合规要求,让安全弱点无所遁形。 展开 收起
XML
Apache-2.0
取消

发行版

暂无发行版

贡献者

全部

近期动态

加载更多
不能加载更多了
XML
1
https://gitee.com/HuaweiCloudDeveloper/huaweicloud-vss-api-jenkins-intergration-sample.git
git@gitee.com:HuaweiCloudDeveloper/huaweicloud-vss-api-jenkins-intergration-sample.git
HuaweiCloudDeveloper
huaweicloud-vss-api-jenkins-intergration-sample
huaweicloud-VSS-API-jenkins-intergration-sample
master-dev

搜索帮助