The information in this document applies to version 6.9.8.2 of Syhunt Hybrid.
Table of Contents
Activating a Syhunt Runner |
Adding Syhunt to your Actions YML script |
Start-DynamicScan Function |
Start-CodeScan Function |
Pass/Fail Conditions |
Integrating with GitHub Issues |
Launching Syhunt scans from within a GitHub Actions YML script is simple and straightforward, allowing you to integrate the Syhunt Dynamic, Syhunt Code and Syhunt Mobile security testing tools into your continuous delivery pipeline. You can also configure GitHub issue trackers in Syhunt, allowing vulnerabilities to be submitted to the issues area of projects.
The following example GitHub Actions YML script will scan the current repository source code, failing the job if medium or high vulnerabilities are identified. In addition to this, and it attachs a PDF vulnerability report to the pipeline job artifacts.
name: syhunt test
on:
push:
branches:
- main
jobs:
build:
runs-on: [self-hosted, Windows, X64]
steps:
- uses: actions/checkout@v2
- run: Start-CodeScan -pfcond 'fail-if:risk=mediumup' -output 'report.pdf'
- name: 'Syhunt Report'
uses: actions/upload-artifact@v2
if: failure()
with:
name: syhunt-report
path: report.pdf
if-no-files-found: error
Syhunt Runner is a CI service that will receive scan requests, execute scans and communicate the scan results with GitHub.
IMPORTANT: For security and performance reasons, it is advised that the Runner is installed on a separated virtual machine or dedicated physical machine.
Syhunt is now ready to be called from GitHub Actions scripts! See examples below
Note: A self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 30 days. In addition to this, each workflow run is limited to 72 hours. If a workflow run reaches this limit, the workflow run is cancelled.
If you don't have a workflow YML file in your repository, create a file like “.github/workflows/blank.yml” at your project’s root path.
SAST Example - The following example Github Actions YML script will scan the current repository source code, failing the job if medium or high vulnerabilities are identified. In addition to this, it attachs a PDF vulnerability report to the pipeline job artifacts.
name: syhunt test
on:
push:
branches:
- main
jobs:
build:
runs-on: [self-hosted, Windows, X64]
steps:
- uses: actions/checkout@v2
- run: Start-CodeScan -pfcond 'fail-if:risk=mediumup' -output 'report.pdf'
- name: 'Syhunt Report'
uses: actions/upload-artifact@v2
if: failure()
with:
name: syhunt-report
path: report.pdf
if-no-files-found: error
DAST Example - The following example Github Actions YML script will scan the live web application after going into production, failing the job if medium or high vulnerabilities are identified. In addition to this, it attachs a PDF vulnerability report to the pipeline job artifacts.
name: syhunt test
on:
push:
branches:
- main
jobs:
build:
runs-on: [self-hosted, Windows, X64]
steps:
- uses: actions/checkout@v2
- run: Start-DynamicScan -target 'www.productionurl.com' -pfcond 'fail-if:risk=mediumup' -output 'report.pdf'
- name: 'Syhunt Report'
uses: actions/upload-artifact@v2
if: failure()
with:
name: syhunt-report
path: report.pdf
if-no-files-found: error
# SAST Example - Scan local directory/repository
Start-CodeScan -pfcond "medium"
# SAST Example - Scan a remote project repository
$MyProject = @{
target = 'https://github.com/syhunt/vulnphp.git';
branch = 'main';
pfcond = 'medium';
output = 'report.pdf'
}
Start-CodeScan @MyProject
# DAST Example - Scan URL
$MyWebsite= @{
target = 'https://www.somewebsite.com';
pfcond = 'medium';
output = 'report.pdf'
}
Start-DynamicScan @MyWebsite
Syhunt Dynamic must be launched through the Start-DynamicScan() function. The following parameters must be provided when calling the Start-DynamicScan() function:
When using the output or outputex parameters, all output formats supported by Syhunt are available. The report or export will be saved to the current working directory, unless a full path name is provided.
Examples:
# Example 1 - Scan URL with single line
Start-DynamicScan -target 'https://www.somewebsite.com' -pfcond 'fail-if:risk=mediumup'
# Example 2 - Scan URL
$MyWebsite= @{
target = 'https://www.somewebsite.com';
pfcond = 'medium';
output = 'report.pdf'
}
Start-DynamicScan @MyWebsite
Syhunt Code must be launched through the Start-CodeScan() function. The following parameters can be provided when calling the Start-CodeScan() function, all of which are optional:
When using the output or outputex parameters, all output formats supported by Syhunt are available. The report or export will be saved to the current working directory, unless a full path name is provided.
Examples:
# Example 1 - Scan the current directory/repository
Start-CodeScan -pfcond "medium"
# Example 2 - Scan a remote GIT project
Start-CodeScan -target "https://github.com/someuser/somerepo.git" -huntmethod "normal" -pfcond "medium"
# Example 2 - Scan a remote Azure DevOps Services project
Start-CodeScan -target "https://dev.azure.com/user/projectname" -huntmethod "normal" -pfcond "medium"
# Example 4 - Scan a specific local directory
Start-CodeScan -target "C:\www\" -huntmethod "normal" -pfcond "medium"
The following are the pass/fail conditions currently supported by Syhunt:
high
or fail-if:risk=high
- Fail if a High risk vulnerability or threat is found
medium
or fail-if:risk=mediumup
- Fail if a Medium or High risk vulnerability or threat is found
low
or fail-if:risk=lowup
- Fail if a Low, Medium or High risk vulnerability or threat is found
Configuring an issue tracker is an easy task and vulnerabilities can be submitted to a specific project with the click of a button.
For more details on how to submit vulnerabilities to the GitHub tracker, see: Submitting Vulnerabilities To a Tracker.
For additional product documentation, visit syhunt.com/docs