testing-security（测试安全性）

testing-security

Purpose

This skill automates security testing by integrating DAST tools (OWASP ZAP, Nuclei), SAST tools (Semgrep, Bandit), SCA tools (Snyk, Trivy), and secrets scanners (detect-secrets, TruffleHog) to identify vulnerabilities in code, applications, and secrets.

When to Use

Use this skill during CI/CD pipelines, before deployments, or for periodic audits; ideal for projects with web apps, APIs, or codebases in languages like Python, Java, or JavaScript where security flaws could lead to breaches.

Key Capabilities

• DAST: Run OWASP ZAP for active scanning of web apps, detecting issues like XSS or SQLi; use Nuclei for custom vulnerability templates.
• SAST: Execute Semgrep for pattern-based code analysis (e.g., YAML rulesets) or Bandit for Python-specific flaws like insecure imports.
• SCA: Leverage Snyk to scan dependencies for known CVEs via SBOM analysis; use Trivy for container image scanning with vulnerability databases.
• Secrets Detection: Apply detect-secrets to scan files for patterns like API keys; use TruffleHog for Git history scans to find exposed secrets.
• Integration: Combine tools in a single workflow, e.g., run SAST on code changes and DAST on staging environments.

Usage Patterns

Always configure tools via environment variables for authentication (e.g., $ZAP_API_KEY for OWASP ZAP, $SNYK_TOKEN for Snyk). Start with a baseline scan on new projects, then automate in scripts.

• Pattern 1: For CI/CD, trigger SAST on pull requests and DAST on builds; example: Use GitHub Actions to run Semgrep on diffed files.
• Pattern 2: For local testing, chain tools sequentially—first run Trivy on Docker images, then Nuclei on URLs.
• Example 1: To scan a Python repo for SAST and secrets: Install tools, run Bandit on files, then detect-secrets; output results to a JSON report for parsing.
• Example 2: For a web app, perform DAST: Start OWASP ZAP in daemon mode, use zap-cli to scan a URL, and follow with Nuclei for specific exploits.

Common Commands/API

Use these exact commands in scripts or terminals; ensure dependencies are installed (e.g., via pip or Docker).

• OWASP ZAP (DAST): Start with zap.sh -daemon -port 8080, then scan via zap-cli -p 8080 quick-scan --spider https://target.com --report html. API endpoint: POST to /JSON/core/action/newSession/ with $ZAP_API_KEY.
• Nuclei (DAST): Run nuclei -t templates/ -u https://target.com -o results.txt; use config file like nuclei-config.yaml with severity levels.
• Semgrep (SAST): Execute semgrep --config p/default --lang python.; customize with a .semgrep.yml file: rules: - id: no-os-system patterns: - pattern: os.system(...).
• Bandit (SAST): Command: bandit -r /path/to/code -f json; ignore paths via -x tests/.
• Snyk (SCA): Authenticate with $SNYK_TOKEN, then snyk test --file=requirements.txt; API: GET https://snyk.io/api/v1/org/{orgId}/projects for project lists.
• Trivy (SCA): Scan image: trivy image myimage:latest --exit-code 1 --severity CRITICAL; config via .trivy.yaml with ignoreUnfixed: true.
• detect-secrets (Secrets): Run detect-secrets scan >.secrets.baseline; use with Git hook: detect-secrets hook --baseline.secrets.baseline.
• TruffleHog (Secrets): Command: trufflehog git https://github.com/repo --since-commit HEAD~1; filter with --regex for patterns.

Integration Notes

Integrate via scripts or orchestration tools like Jenkins or GitHub Actions; pass outputs as JSON for chaining. For auth, set env vars like $TRIVY_USERNAME and $TRIVY_PASSWORD. Use Docker images (e.g., owasp/zap2docker-stable) for isolated runs. Config formats: YAML for Semgrep rules (e.g., {patterns: [pattern: "regex"]}), JSON for Snyk reports. Ensure tools are version-pinned (e.g., Semgrep v0.100.0) to avoid breaking changes.

Error Handling

Check exit codes after each command (e.g., Semgrep returns non-zero on findings); parse errors from stdout, like OWASP ZAP's JSON responses for "error" keys. Common issues: Network errors in DAST—retry with zap-cli --retries 3; authentication failures—verify env vars (e.g., if $SNYK_TOKEN is invalid, output "Auth error"). Log all outputs to files and handle via try-catch in scripts, e.g., in Bash: zap-cli quick-scan || echo "Scan failed: $?" >> error.log. For API calls, check HTTP status codes (e.g., 401 for unauthorized).

Graph Relationships

• Related to: "testing" cluster (e.g., links to unit-testing or integration-testing skills for combined workflows).
• Depends on: OWASP ZAP for DAST, Semgrep for SAST.
• Integrates with: Snyk API for SCA, TruffleHog for secrets in version control systems.