Project Information

• Incubator Project

Audience

• Builder
• Breaker
• Defender

OWASP-iGNITA

Static application security testing environment with SAST scanner and plugins

Code Repository

• Github Repository

Security Policy

Supported Versions

Use this section to tell people about which versions of your project are currently being supported with security updates.

Version	Supported
5.1.x
5.0.x
4.0.x
< 4.0

Reporting a Vulnerability

Use this section to tell people how to report a vulnerability.

Tell them where to go, how often they can expect to get an update on a reported vulnerability, what to expect if the vulnerability is accepted or declined, etc.

Project Overview

Building a Standalone Scanner and staging the results to detect OWASP TOP 10 Vulnerabilities and building plugins for IDE’s and Continuous Integration

Project Proposal

As the increase of software development, billions of lines of code is being produced but the quality of the code is menacing thereby the vulnerability of applications are threatening, even though there are many tools to monitor applications for vulnerabilities it’s always too late. One of the solutions to this is to analyse and fix these vulnerable code while development, but there are only few tools available for scanning the code vulnerabilities. OWASP iGNITA is a fine example for such a tool, but because of many third party dependencies, setting up the framework for testing is time consuming and a bit disorderd.

Proposed Strategy

To overcome the above mentioned problems, It is a fine game plan to build an own standalone analyser to detect vulnerabilities where the OWASP iGNITA Scanner will be independent from tools such as OWASP SonarQube, which will make the Framework more light and easy to set up, and users won’t be restricted to the API provided by the sonarqube or other scanners of such. Also creating a plugin for IDE’s which will be a faster way to detect vulnerabilities. And dockerize the Framework so the set up time will be minimal and less hectic. This plugin will also be proposed to be integrated into DevSecOps toolchain; github/jenkins/owasp appsec pipelines. Additionally a developer guide will be written with guidelines, templates and other titles for future collaborators.

Requirement which satisfy the Important Selection Criteria,

• Vulnerabilities it can detect (out of the OWASP Top Ten?) - Focused on top Ten
• Can it be integrated into the developer’s IDE? - Plugin is proposed to be developed
• How hard is it to set up/use? - Dockerizing for easy setup
• Can it be run continuously and automatically? - Will be tested and added to pipeline in github

High level architecture diagram

Features of the Analyzer

• The analyzer will initially focus on JAVA language
• Analyzer will be built to detect owasp top 10 vulnerabilities such as,
  • Injection
  • Broken Authentication
  • Sensitive Data Exposure
  • XEE
  • Broken Access Control
  • Security Misconfig
  • Cross site Scripting
  • Insecure deserialization

Timeline

Project Team & Organization

• Azzeddine Ramrami: Project Leader
• Azhar Aahmad: Project Leader and back-end developper

User Guide

Installation

Pre-requisites

Software

• NodeJS (required)
• Angular (required)
• SonarQube (required)
• Sonar-scanner (required)
• Mongodb (required)
• Git (required)

Installing pre-requisites

NodeJS:
https://nodejs.org/en/download/

Angular:
https://angular.io/

SonarQube:
https://www.sonarqube.org/downloads/

Sonar-Scanner:
https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/

Mongodb:
https://www.mongodb.com/download-center/community

Procedure for installing

Step 1 :

Get the resource file from github

Clone the project : $ git clone https://github.com/azharanees/OWASP-iGNITA.git

Or

Download the project from: https://owasp.org/www-project-ignita/

Step 2:

Start the mongodb server and make sure it’s running on port : 28017

Step 3:

Start the sonarqube server on port : 9000

Step 4:

Make sure sonar-scanner is installed and add included in the environment variables

Step 5:

Make sure sonar-scanner is installed and included in the environment variables

Step 6:

Goto the cloned repository folder and change directory to “api” cd api when you are inside the directory run : npm install which will install the required dependencies

Step 6:

After successfully executing npm install start the node server using npm start.

Step 7:

Change the directory to the gui folder from the root directory. cd gui from the root directory

Step 8:

when you are inside the gui directory use npm install to install all the relevant dependencies.

Step 9:

After completing the installation use ng serve or npm start to run the Angular App.

Step 10:

After the angular app successfully compiled open your browser and goto your localhost:4200

Step 11:

Use the below credentials to login to the dashboard

username : admin 
password : test1234

Guide to use the dashboard

Example

Put whatever you like here: news, screenshots, features, supporters, or remove this file and don’t use tabs at all.