Skip to content

Commit 3f96af9

Browse files
thc202thc202
authored
Merge pull request #234 from kingthorin/even-more
auth test: Add Even more
2 parents 477cb9b + eee5a03 commit 3f96af9

File tree

6 files changed

+219
-0
lines changed

6 files changed

+219
-0
lines changed

‎scans/auth/plans_and_scripts/authtestdelay/bbaplus.yaml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
env:
2+
contexts:
3+
- name: Authentication Test
4+
urls:
5+
- https://authenticationtest.com
6+
includePaths:
7+
- https://authenticationtest.com.*
8+
authentication:
9+
method: browser
10+
parameters:
11+
loginPageUrl: https://authenticationtest.com/delayChallenge/
12+
loginPageWait: 2
13+
browserId: firefox-headless
14+
verification:
15+
method: response
16+
loggedInRegex: loginSuccess|mode=logout
17+
pollFrequency: 60
18+
pollUnits: requests
19+
pollUrl: ""
20+
pollPostData: ""
21+
sessionManagement:
22+
method: cookie
23+
technology: {}
24+
structure: {}
25+
users:
26+
- name: testuser
27+
credentials:
28+
username: ${zapusername}
29+
password: ${zappassword}
30+
jobs:
31+
- type: passiveScan-config
32+
parameters:
33+
disableAllRules: true
34+
rules:
35+
- name: Authentication Request Identified
36+
id: 10111
37+
threshold: medium
38+
- name: Session Management Response Identified
39+
id: 10112
40+
threshold: medium
41+
- name: Verification Request Identified
42+
id: 10113
43+
threshold: medium
44+
- type: requestor
45+
parameters:
46+
user: testuser
47+
requests:
48+
- url: ${zapsite}
49+
- type: passiveScan-wait
50+
parameters: {}
51+
- name: auth-test-report
52+
type: report
53+
parameters:
54+
template: auth-report-json
55+
theme: null
56+
reportDir: .
57+
reportFile: auth-report.json
58+
reportTitle: ZAP by Checkmarx Scanning Report
59+
sections:
60+
- summary
61+
- afenv
62+
- statistics

‎scans/auth/plans_and_scripts/authtestdelay/config

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
zapsite=https://authenticationtest.com/delayChallenge/
2+
zaploginurl=https://authenticationtest.com/delayChallenge/

‎scans/auth/plans_and_scripts/authtestmulti/bbaplus.yaml

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
env:
2+
contexts:
3+
- name: Authentication Test
4+
urls:
5+
- https://authenticationtest.com/
6+
includePaths:
7+
- https://authenticationtest.com.*
8+
authentication:
9+
method: browser
10+
parameters:
11+
loginPageUrl: https://authenticationtest.com/multiStepAuth/
12+
loginPageWait: 2
13+
browserId: firefox-headless
14+
steps:
15+
- description: Fill Email
16+
type: USERNAME
17+
xpath: "//*[@id=\"email\"]"
18+
timeout: 1000
19+
- description: Email Next
20+
type: CLICK
21+
xpath: "/html/body/div/div/div[2]/form/input"
22+
timeout: 1000
23+
- description: Fill password
24+
type: PASSWORD
25+
xpath: "//*[@id=\"password\"]"
26+
timeout: 1000
27+
- description: Log In
28+
type: RETURN
29+
xpath: "/html/body/div/div/div[2]/form/input"
30+
timeout: 1000
31+
verification:
32+
method: response
33+
loggedInRegex: loginSuccess|mode=logout
34+
pollFrequency: 60
35+
pollUnits: requests
36+
pollUrl: ""
37+
pollPostData: ""
38+
sessionManagement:
39+
method: cookie
40+
technology: {}
41+
structure: {}
42+
users:
43+
- name: testuser
44+
credentials:
45+
username: ${zapusername}
46+
password: ${zappassword}
47+
jobs:
48+
- type: passiveScan-config
49+
parameters:
50+
disableAllRules: true
51+
rules:
52+
- name: Authentication Request Identified
53+
id: 10111
54+
threshold: medium
55+
- name: Session Management Response Identified
56+
id: 10112
57+
threshold: medium
58+
- name: Verification Request Identified
59+
id: 10113
60+
threshold: medium
61+
- type: requestor
62+
parameters:
63+
user: testuser
64+
requests:
65+
- url: ${zapsite}
66+
- type: passiveScan-wait
67+
parameters: {}
68+
- name: auth-test-report
69+
type: report
70+
parameters:
71+
template: auth-report-json
72+
theme: null
73+
reportDir: .
74+
reportFile: auth-report.json
75+
reportTitle: ZAP by Checkmarx Scanning Report
76+
sections:
77+
- summary
78+
- afenv
79+
- statistics

‎scans/auth/plans_and_scripts/authtestmulti/config

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
zapsite=https://authenticationtest.com/multiStepAuth/
2+
zaploginurl=https://authenticationtest.com/multiStepAuth/

‎scans/auth/plans_and_scripts/authtesttotp/bbaplus.yaml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
env:
2+
contexts:
3+
- name: Authentication Test
4+
urls:
5+
- https://authenticationtest.com/
6+
includePaths:
7+
- https://authenticationtest.com.*
8+
authentication:
9+
method: browser
10+
parameters:
11+
loginPageUrl: https://authenticationtest.com/totpChallenge/
12+
loginPageWait: 2
13+
browserId: firefox-headless
14+
steps:
15+
- description: TOTP
16+
type: TOTP_FIELD
17+
cssSelector: "#totpmfa"
18+
timeout: 1000
19+
verification:
20+
method: response
21+
loggedInRegex: loginSuccess|mode=logout
22+
pollFrequency: 60
23+
pollUnits: requests
24+
pollUrl: ""
25+
pollPostData: ""
26+
sessionManagement:
27+
method: cookie
28+
technology: {}
29+
structure: {}
30+
users:
31+
- name: testuser
32+
credentials:
33+
totp:
34+
secret: I65VU7K5ZQL7WB4E
35+
period: 30
36+
digits: 6
37+
algorithm: SHA1
38+
username: ${zapusername}
39+
password: ${zappassword}
40+
jobs:
41+
- type: passiveScan-config
42+
parameters:
43+
disableAllRules: true
44+
rules:
45+
- name: Authentication Request Identified
46+
id: 10111
47+
threshold: medium
48+
- name: Session Management Response Identified
49+
id: 10112
50+
threshold: medium
51+
- name: Verification Request Identified
52+
id: 10113
53+
threshold: medium
54+
- type: requestor
55+
parameters:
56+
user: testuser
57+
requests:
58+
- url: ${zapsite}
59+
- type: passiveScan-wait
60+
parameters: {}
61+
- name: auth-test-report
62+
type: report
63+
parameters:
64+
template: auth-report-json
65+
theme: null
66+
reportDir: .
67+
reportFile: auth-report.json
68+
reportTitle: ZAP by Checkmarx Scanning Report
69+
sections:
70+
- summary
71+
- afenv
72+
- statistics

‎scans/auth/plans_and_scripts/authtesttotp/config

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
zapsite=https://authenticationtest.com/totpChallenge/
2+
zaploginurl=https://authenticationtest.com/totpChallenge/

0 commit comments

Comments
 (0)