Skip to content

Commit a2a0667

Browse files
jgadsdenjgadsden
authored
add ToC handling to release pipeline
2 parents f479f95 + fa22aea commit a2a0667

File tree

24 files changed

+181
-196
lines changed

24 files changed

+181
-196
lines changed

‎.github/workflows/release.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,11 @@ jobs:
145145
find release -name "*.md" -exec sed -i ':a; /^\n*$/{ s/\n//; N; ba};' {} +
146146
find release -name "*.md" -exec sed -i '${/^$/d;}' {} +
147147
148+
- name: Fix up ToC sidebar
149+
run: |
150+
cp _data/draft.yaml _data/release.yaml
151+
sed -i "s/^docs_list_title.*/docs_list_title: Developer Guide/" _data/release.yaml
152+
148153
- name: Retrieve pdfs and epubs
149154
uses: actions/[email protected]
150155
with:

‎_data/draft.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ docs:
163163
- title: '6.2 Tools'
164164
url: verification/tools
165165

166-
- title: '6.2.1 DAST'
166+
- title: '6.2.1 DAST tools'
167167
url: verification/tools/dast
168168

169169
- title: '6.2.2 Amass'

‎_data/release-pt-br.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,8 @@ docs:
190190
- title: '6.2 Tools'
191191
url: verification/tools
192192

193-
- title: '6.2.1 Zed Attack Proxy'
194-
url: verification/tools/zed_attack_proxy
193+
- title: '6.2.1 DAST tools'
194+
url: verification/tools/dast
195195

196196
- title: '6.2.2 Amass'
197197
url: verification/tools/amass

‎_data/release.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -163,8 +163,8 @@ docs:
163163
- title: '6.2 Tools'
164164
url: verification/tools
165165

166-
- title: '6.2.1 Zed Attack Proxy'
167-
url: verification/tools/zed_attack_proxy
166+
- title: '6.2.1 DAST tools'
167+
url: verification/tools/dast
168168

169169
- title: '6.2.2 Amass'
170170
url: verification/tools/amass

‎draft/02-toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ permalink:
7373
6.1.2 [MAS Testing Guide](#mas-testing-guide)
7474
6.1.3 [Application Security Verification Standard](#application-security-verification-standard)
7575
6.2 [Tools](#verification-tools)
76-
6.2.1 [DAST](#dast)
76+
6.2.1 [DAST tools](#dast-tools)
7777
6.2.2 [Amass](#amass)
7878
6.2.3 [Offensive Web Testing Framework](#offensive-web-testing-framework)
7979
6.2.4 [Nettacker](#nettacker)

‎draft/05-requirements/03-opencre.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ This provides an overview of tools and techniques used for most SDLCs.
4848
* OWASP [Proactive Controls][proactiveocre]
4949
* OWASP [Cheat Sheets][csocre]
5050
* OWASP [WSTG][wstgocre]
51-
* [ZAP][zapocre] from [Crash Override][crash]
51+
* [ZAP][zapocre]
5252

5353
The aim of this project is to 'Link all the things with OpenCRE' which will:
5454

@@ -105,7 +105,6 @@ then [submit an issue][issue0503] or [edit on GitHub][edit0503].
105105

106106
[asvs]: https://owasp.org/www-project-application-security-verification-standard/
107107
[capecocre]: https://opencre.org/search/CAPEC
108-
[crash]: https://crashoverride.com/
109108
[csocre]: https://opencre.org/search/OWASP%20Cheat%20Sheets
110109
[cweocre]: https://opencre.org/search/CWE
111110
[cwe]: https://cwe.mitre.org/

‎draft/08-verification/00-toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ Sections:
4444
6.1.2 [MAS Testing Guide](#mas-testing-guide)
4545
6.1.3 [Application Security Verification Standard](#application-security-verification-standard)
4646
6.2 [Tools](#verification-tools)
47-
6.2.1 [DAST](#dast)
47+
6.2.1 [DAST tools](#dast-tools)
4848
6.2.2 [Amass](#amass)
4949
6.2.3 [Offensive Web Testing Framework](#offensive-web-testing-framework)
5050
6.2.4 [Nettacker](#nettacker)

‎draft/08-verification/02-tools/00-toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ whereas manual security testing of high-risk components requires good knowledge
2727

2828
Sections:
2929

30-
6.2.1 [DAST](#dast)
30+
6.2.1 [DAST tools](#dast-tools)
3131
6.2.2 [Amass](#amass)
3232
6.2.3 [Offensive Web Testing Framework](#offensive-web-testing-framework)
3333
6.2.4 [Nettacker](#nettacker)

‎draft/08-verification/02-tools/01-dast.md

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
title: DAST
44
layout: col-document
55
tags: OWASP Developer Guide
6-
contributors: Jon Gadsden, Johan Sydseter
6+
contributors: Johan Sydseter, Jon Gadsden
77
document: OWASP Developer Guide
8-
order: 821
9-
permalink: /draft/verification/tools/dast/
8+
order: 8210
9+
permalink: /release/verification/tools/dast/
1010

1111
---
1212

@@ -37,9 +37,10 @@ by actually performing attacks.
3737

3838
#### Different DAST tools
3939

40-
The OWASP Community projects contains a [list of DAST tools][dast] can be used to conduct DAST. All of these tools have
41-
their own strengths and weaknesses. If you are interested in the effectiveness of DAST tools, check out the
42-
[OWASP Benchmark][benchmark] project, which attempts to scientifically measure the effectiveness of all types of
40+
The OWASP Community projects contains a [list of DAST tools][dast] that can be used to conduct DAST.
41+
All of these tools have their own strengths and weaknesses.
42+
If you are interested in the effectiveness of DAST tools, check out the [OWASP Benchmark][benchmark] project,
43+
which attempts to scientifically measure the effectiveness of all types of
4344
vulnerability detection tools, including DAST.
4445

4546
#### Why use it?

‎draft/08-verification/02-tools/toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ whereas manual security testing of high-risk components requires good knowledge
3838

3939
Sections:
4040

41-
6.2.1 [DAST](01-dast.md)
41+
6.2.1 [DAST tools](01-dast.md)
4242
6.2.2 [Amass](02-amass.md)
4343
6.2.3 [Offensive Web Testing Framework](03-owtf.md)
4444
6.2.4 [Nettacker](04-nettacker.md)

‎draft/08-verification/03-frameworks/01-secure-codebox.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ OWASP secureCodeBox orchestrates a range of security-testing tools in various do
6262
* Nikto web server vulnerability scanner
6363
* Nuclei template based vulnerability scanner.
6464
* Screenshooter takes screenshots of websites
65-
* ZAP and ZAP Advanced web application & OpenAPI vulnerability scanner extend with authentication features
65+
* ZAP Advanced web application & OpenAPI vulnerability scanner
6666

6767
Other tools may be added over time.
6868

‎draft/08-verification/toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ Sections:
5555
6.1.2 [MAS Testing Guide](01-guides/02-mastg.md)
5656
6.1.3 [Application Security Verification Standard](01-guides/03-asvs.md)
5757
6.2 [Tools](02-tools/toc.md)
58-
6.2.1 [DAST](02-tools/01-dast.md)
58+
6.2.1 [DAST tools](02-tools/01-dast.md)
5959
6.2.2 [Amass](02-tools/02-amass.md)
6060
6.2.3 [Offensive Web Testing Framework](02-tools/03-owtf.md)
6161
6.2.4 [Nettacker](02-tools/04-nettacker.md)

‎draft/09-training-education/01-vulnerable-apps/02-webgoat.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ permalink: /draft/training_education/vulnerable_applications/webgoat/
2828

2929
The OWASP [WebGoat][webgoat] project is a deliberately insecure web application that can be
3030
used to attack common application vulnerabilities in a safe environment.
31-
It can also be used to exercise application security tools, such as [ZAP][zap], to practice
31+
It can also be used to exercise application security tools to practice
3232
scanning and identifying the various vulnerabilities built into WebGoat.
3333

3434
WebGoat is a well established OWASP project and achieved Lab Project status many years ago.
@@ -105,7 +105,7 @@ WebWolf provides:
105105

106106
Try all the WebGoat lessons, they will certainly inform and educate.
107107
Use WebGoat in demonstrations of your favourite attack chains.
108-
Exercise Zap and Burp Suite against WebGoat, or other attack tools you have with you.
108+
Exercise available attack tools against WebGoat.
109109

110110
Try out the WebGoat desktop environment by running `docker run -p 127.0.0.1:3000:3000 webgoat/webgoat-desktop`
111111
and navigating to `http://localhost:3000/`.
@@ -116,7 +116,6 @@ There are various ways of configuring WebGoat, see the [github repo][goatgithub]
116116

117117
* OWASP [WebGoat][webgoat] and WebWolf
118118
* [Docker][dockerinstall]
119-
* [ZAP][zap]
120119

121120
----
122121

@@ -130,6 +129,5 @@ then [submit an issue][issue090102] or [edit on GitHub][edit090102].
130129
[edit090102]: https://github.com/OWASP/www-project-developer-guide/blob/main/draft/09-training-education/01-vulnerable-apps/02-webgoat.md
131130
[issue090102]: https://github.com/OWASP/www-project-developer-guide/issues/new?labels=enhancement&template=request.md&title=Update:%2009-training-education/01-vulnerable-apps/02-webgoat
132131
[webgoat]: https://owasp.org/www-project-webgoat/
133-
[zap]: https://www.zaproxy.org/
134132

135133
\newpage

‎draft/toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ This draft version has the latest contributions to the Developer Guide so expect
7979
6.1.2 [MAS Testing Guide](08-verification/01-guides/02-mastg.md)
8080
6.1.3 [Application Security Verification Standard](08-verification/01-guides/03-asvs.md)
8181
6.2 [Tools](08-verification/02-tools/toc.md)
82-
6.2.1 [DAST](08-verification/02-tools/01-dast.md)
82+
6.2.1 [DAST tools](08-verification/02-tools/01-dast.md)
8383
6.2.2 [Amass](08-verification/02-tools/02-amass.md)
8484
6.2.3 [Offensive Web Testing Framework](08-verification/02-tools/03-owtf.md)
8585
6.2.4 [Nettacker](08-verification/02-tools/04-nettacker.md)

‎release-pt-br/02-toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ permalink:
7373
6.1.2 [MAS Testing Guide](#mas-testing-guide)
7474
6.1.3 [Application Security Verification Standard](#application-security-verification-standard)
7575
6.2 [Tools](#verification-tools)
76-
6.2.1 [Zed Attack Proxy](#zed-attack-proxy)
76+
6.2.1 [DAST tools](#dast-tools)
7777
6.2.2 [Amass](#amass)
7878
6.2.3 [Offensive Web Testing Framework](#offensive-web-testing-framework)
7979
6.2.4 [Nettacker](#nettacker)

‎release-pt-br/08-verification/00-toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ Sections:
4444
6.1.2 [MAS Testing Guide](#mas-testing-guide)
4545
6.1.3 [Application Security Verification Standard](#application-security-verification-standard)
4646
6.2 [Tools](#verification-tools)
47-
6.2.1 [Zed Attack Proxy](#zed-attack-proxy)
47+
6.2.1 [DAST tools](#dast-tools)
4848
6.2.2 [Amass](#amass)
4949
6.2.3 [Offensive Web Testing Framework](#offensive-web-testing-framework)
5050
6.2.4 [Nettacker](#nettacker)

‎release-pt-br/08-verification/02-tools/00-toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ whereas manual security testing of high-risk components requires good knowledge
2727

2828
Sections:
2929

30-
6.2.1 [Zed Attack Proxy](#zed-attack-proxy)
30+
6.2.1 [DAST tools](#dast-tools)
3131
6.2.2 [Amass](#amass)
3232
6.2.3 [Offensive Web Testing Framework](#offensive-web-testing-framework)
3333
6.2.4 [Nettacker](#nettacker)

‎release-pt-br/08-verification/02-tools/01-dast.md

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
---
2+
3+
title: DAST
4+
layout: col-document
5+
tags: OWASP Developer Guide
6+
contributors: Johan Sydseter, Jon Gadsden
7+
document: OWASP Developer Guide
8+
order: 28210
9+
permalink: /release-pt-br/verification/tools/dast/
10+
11+
---
12+
13+
{% include breadcrumb.html %}
14+
15+
<style type="text/css">
16+
.image-right {
17+
height: 180px;
18+
display: block;
19+
margin-left: auto;
20+
margin-right: auto;
21+
float: right;
22+
}
23+
</style>
24+
25+
Dynamic application security testing (DAST) represents a non-functional testing process to identify security weaknesses and
26+
vulnerabilities in applications. The testing process can be carried out manually or be automated. Manual assessment of an
27+
application involves human intervention to identify security flaws which might slip from an automated tool. Usually
28+
business logic errors, race condition checks, and certain zero-day vulnerabilities can only be identified using manual
29+
assessments.
30+
31+
### 6.2.1 DAST tools
32+
33+
DAST tools are programs which communicates with a web application through the web front-end in order to identify potential
34+
security vulnerabilities in the web application and architectural weaknesses. It performs a black-box test. Unlike static
35+
application security testing tools, DAST tools do not have access to the source code and therefore detect vulnerabilities
36+
by actually performing attacks.
37+
38+
#### Different DAST tools
39+
40+
The OWASP Community projects contains a [list of DAST tools][dast] that can be used to conduct DAST.
41+
All of these tools have their own strengths and weaknesses.
42+
If you are interested in the effectiveness of DAST tools, check out the [OWASP Benchmark][benchmark] project,
43+
which attempts to scientifically measure the effectiveness of all types of
44+
vulnerability detection tools, including DAST.
45+
46+
#### Why use it?
47+
48+
The big advantage of these types of tools are that they can scan year-round to be constantly searching for vulnerabilities.
49+
With new vulnerabilities being discovered regularly this allows companies to find and patch vulnerabilities before they
50+
can become exploited.
51+
52+
#### Cons
53+
54+
Because these tools does dynamic testing, it cannot cover 100% of the source code of the application and then, the
55+
application itself. The penetration tester should look at the coverage of the web application or of its attack surface to
56+
know if the tool was configured correctly or was able to understand the web application.
57+
58+
#### References
59+
60+
* [Dynamic application security testing][wikipedia]
61+
* [Vulnerability Scanning Tools][dast]
62+
63+
----
64+
65+
The OWASP Developer Guide is a community effort; if there is something that needs changing
66+
then [submit an issue][issue080201] or [edit on GitHub][edit080201].
67+
68+
[benchmark]: https://owasp.org/www-project-benchmark/
69+
[dast]: https://owasp.org/www-community/Vulnerability_Scanning_Tools
70+
[edit080201]: https://github.com/OWASP/www-project-developer-guide/blob/main/draft/08-verification/02-tools/01-dast.md
71+
[issue080201]: https://github.com/OWASP/www-project-developer-guide/issues/new?labels=content&template=request.md&title=Update:%2008-verification/02-tools/01-dast
72+
[wikipedia]: https://en.wikipedia.org/wiki/Dynamic_application_security_testing
73+
74+
\newpage

‎release-pt-br/08-verification/02-tools/01-zap.md

Lines changed: 0 additions & 83 deletions
This file was deleted.

‎release-pt-br/08-verification/02-tools/toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ whereas manual security testing of high-risk components requires good knowledge
3838

3939
Sections:
4040

41-
6.2.1 [Zed Attack Proxy](01-zap.md)
41+
6.2.1 [DAST tools](01-dast.md)
4242
6.2.2 [Amass](02-amass.md)
4343
6.2.3 [Offensive Web Testing Framework](03-owtf.md)
4444
6.2.4 [Nettacker](04-nettacker.md)

‎release-pt-br/08-verification/toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ Sections:
5555
6.1.2 [MAS Testing Guide](01-guides/02-mastg.md)
5656
6.1.3 [Application Security Verification Standard](01-guides/03-asvs.md)
5757
6.2 [Tools](02-tools/toc.md)
58-
6.2.1 [Zed Attack Proxy](02-tools/01-zap.md)
58+
6.2.1 [DAST tools](02-tools/01-dast.md)
5959
6.2.2 [Amass](02-tools/02-amass.md)
6060
6.2.3 [Offensive Web Testing Framework](02-tools/03-owtf.md)
6161
6.2.4 [Nettacker](02-tools/04-nettacker.md)

‎release-pt-br/toc.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ permalink: /release-pt-br/
7979
6.1.2 [MAS Testing Guide](08-verification/01-guides/02-mastg.md)
8080
6.1.3 [Application Security Verification Standard](08-verification/01-guides/03-asvs.md)
8181
6.2 [Tools](08-verification/02-tools/toc.md)
82-
6.2.1 [Zed Attack Proxy](08-verification/02-tools/01-zap.md)
82+
6.2.1 [DAST tools](08-verification/02-tools/01-dast.md)
8383
6.2.2 [Amass](08-verification/02-tools/02-amass.md)
8484
6.2.3 [Offensive Web Testing Framework](08-verification/02-tools/03-owtf.md)
8585
6.2.4 [Nettacker](08-verification/02-tools/04-nettacker.md)

0 commit comments

Comments
 (0)