Proof of Concept for building Application Security Posture Management (ASPM) based on Directus Headless-CMS.
docker-compose up
use following credentials to login to Directus:
email: [email protected]
password: d1r3ctu5
Make copy of .env.example and rename it to .env, add necessary credentials and settings.
In current PoC you will need to provide
- Github token to be able to load data from Github.
- Directus admin API key to be able to upload results of security scanners.
semgrep scan . --json --json-output=semgrep.json
sed 's/{/{"repository":"https:\/\/api.github.com\/repos\/WebGoat\/WebGoat-Legacy",/' semgrep.json > result.json
curl http://127.0.0.1:8055/flows/trigger/e967dffe-912b-4c5b-8265-b8c101e090ac \
-d @result.json -XPOST \
-H "Authorization: Bearer geBockesPOi-DV71OHf6SbF_EKcMtSz4" \
-H "Content-Type: application/json"nuclei -u http://testphp.vulnweb.com/ -je results.json
curl http://127.0.0.1:8055/flows/trigger/d8612883-7f69-4bcd-af3b-e1e35df6874d \
--data @results.json -XPOST \
-H "Authorization: Bearer geBockesPOi-DV71OHf6SbF_EKcMtSz4" \
-H 'Content-type: application/json'trufflehog git [email protected]:WebGoat/WebGoat-Legacy.git --json > tf.json
while IFS= read -r line;
do curl http://127.0.0.1:8055/flows/trigger/9b47758f-5b3b-4287-8faf-8005759767a9 \
--data "$line" \
-XPOST \
-H "Authorization: Bearer geBockesPOi-DV71OHf6SbF_EKcMtSz4"\
-H 'Content-type: application/json';
done < tf.jsonDetails of extensions development can be found in dev documentation
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent