Write readme and document getting started guide
preetkaran20 opened this issue · comments
While discussing with @nowakkamil found that we are missing readme details and documentation so need to add it.
updated the readme file, however need to update the contributing guideline.
Update the Readme of this project and also https://owasp.org/www-project-vulnerableapp-facade/ which has github repository: https://github.com/OWASP/www-project-vulnerableapp-facade as they both point to old docker image.
Update the Readme of this project and also https://owasp.org/www-project-vulnerableapp-facade/ which has github repository: https://github.com/OWASP/www-project-vulnerableapp-facade as they both point to old docker image.
Updated the docker image links.
Left items in this task:
- Creating a document explaining how to onboard a vulnerable application to the VulnerableApp-facade project.
- A new file explaining, how to contribute to the project. This is needed as we are building the UI in react and might require some explanation regarding coding structure.
- Update readme with the project's tech stack.
- Update https://owasp.org/www-project-vulnerable-web-applications-directory/ project.
Hi, I can help with this. Can you tell me where I can find whatever information is required to do this documentation?
Hi @lmcdo ,
Some of the documentations links which are very uptodate:
Older references but still hold good information:
- Older video explaining about initial project
- Older documentation
- Design document
- Blog
- https://github.com/SasanLabs/VulnerableApp-jsp and https://github.com/SasanLabs/VulnerableApp-php depicting how any vulnerable application can leverage the VulnerableApp-facade.
Please let me know if you need more context, we can discuss over a call.
thanks,
Karan
Hi @lmcdo,
On pointer 1, the way we configure a vulnerable app is via a json contract and you can find the contract details in https://github.com/SasanLabs/VulnerableApp-facade/wiki/Contract-Schema-Design-for-Vulnerable-Applications-to-register-to-VulnerableApp-facade. Also you can look into https://github.com/SasanLabs/VulnerableApp-facade/blob/main/nginx.conf and https://github.com/SasanLabs/VulnerableApp-facade/blob/main/lua-modules/vulnerableapp_utility.lua on how we configured 3 vulnerable apps.
On pointer 2, I think current structure has issues in explaining the ways to debug/local setup, we need a document or a video explaining, how to configure or remove one app under the vulnerable app facade etc in order to just run the application as well as in order to develop or enhance it.
On pointer 3, we just need to tell about the react version we are using in readme as well as npm version. We can also include a video detail explaining how the entire architecture of application is build etc if possible.
Pointer 4, we can ignore.
Thanks,
Karan
Hi @lmcdo,
I think the best way to discuss all these points is over the call. I work in IST timezone till 10 PM IST, so let me know when can we connect? Happy to connect today as well.
thanks,
Karan
@lmcdo Sure works for me, please schedule a meeting on google meet. My email address is: preetkaran20@gmail.com
thanks,
Karan
Hi @lmcdo ,
- I find I still don't have a clue as to the test scanner use case :(
Downloading and running the Facade project is easy enough, and I see that
docker compose downloads and gets the Vulnerable App, plus jsp and php
versions, and then populates the UI. But how is this useful for "testing a
test scanner" which you said was the purpose of this VulnerableApp Facade?
How to use the Levels in this process? There is no clue in the
documentation.
[Karan]
if you go to http://localhost/VulnerabilityDefinitions endpoint, you can see all the vulnerabilities present in the VulnerableApps. So scanners can run against the VulnerableApp and find vulnerabilities and then scanners can compare it with the response from http://localhost/VulnerabilityDefinitions endpoint and see if scanner has found the right vulnerabilities. Please have a look at video https://youtu.be/HRRTrnRgMjs?t=311. The link is from the time where i explain, how Scanners can use VulnerableApp.
- The end user (test scanner dev, security/testing student) will want to
edit their own app vulnerabilities, but these files need to go in the
docker container, and that is why the Readme currently says "make a copy of
docker.compose.yml" in order to deploy the changes that the user makes to
their own code. Should the onboarding document provide a description of the
preferred docker process?
[Karan]
Yes, the newer app onboarding should build a docker and update the docker-compose.yml something like we did for our own vulnerable application.
Have a look at point 1 under https://github.com/SasanLabs/VulnerableApp#building-the-project for more information.
@lmcdo Thanks for all the inputs and hardwork you did for this task. Shall i unassign this task?
thanks,
Karan