.config.yml

version: 2.1
description: |-
  Nexploit is a Machine Learning powered Interactive Application Security Testing (IAST) solution. Automating a cyber-security specialist’s critical thinking process to scan any target and find real vulnerabilities, including logical-flow problems, with no false positives.
  This orb allows you to use Nexploit power in your CI.

  Setup
  Note - An active subscription for Nexploit is needed for usage of this extension.

  Get API Key
  In NexPloit Dashboard navigate to the "Organization" tab and scroll to the "Manage your application API keys" section.
  Press "Create new API key" button and enter any suitable name (circleci key e.g.) Note - Make sure to backup the API key, it can't be restored.

  Using a pre-recorded HAR file
  Upload the file using a simple curl command:

  ```sh
  $ curl -X POST "https://nexploit.app/api/v1/files?discard=true"     \
      -H "Content-Type: multipart/form-data"                          \
      -H "Authorization: Api-Key yufn0f6.yourapikeykuj069zopv0b1i"    \
      -F "har=@/path/to/the/file.har"
  {"ids":["6xkFraa5ecfmHhxTEnabZg"]}
  ```

  This id will then be used for the File ID field.
  When setup is complete, the new scan will start automatically and be visible in your Nexploit account.

display:
  home_url: https://neuralegion.com
  source_url: https://github.com/NeuraLegion/circleci-orb

examples:
  new-scan-curl:
    description: Run a new scan using just curl and Nexploit API
    usage:
      version: 2.1
      orbs:
        nexploit: neuralegion/nexploit@2.0
      jobs:
        build:
          machine: true
          steps:
          - nexploit/new-scan-curl:
              scan_name: My new curl scan
              fileId: 27SJV96JZKdWYjsUCM9M1B
              discovery_types: '"archive", "crawler"'
              protocol: http
  new-scan:
    description: Run a new scan using npm util
    usage:
      version: 2.1
      orbs:
        nexploit: neuralegion/nexploit@2.0
      jobs:
        build:
          machine: true
          steps:
          - nexploit/scan:
              scan_name: CircleCI Scan
              api_key: NEXPLOIT_API_KEY
              discovery_types: 'crawler'
              crawlers: 'https://www.random1.org/,https://www.random2.org/'
              host_filters: 'random1.org,random2.org'
              headers: 'Content-Type: application/json;Keep-Alive: timeout=5, max=1000'
              type: appscan
              protocol: http
  nexploit_job:
    description: Retest a scan and wait for results
    usage:
      version: 2.1
      orbs:
        nexploit: neuralegion/nexploit@2.0
      workflows:
        your-workflow:
          jobs:
          - nexploit/retest-and-poll:
              scan_id: 7MeuiCeFc25WdJBamaaTG
              api_key: NEXPLOIT_API_KEY

commands:
  install:
    description: >
      Installs nexploit-cli util to the environment. You need this util for 
      working with nexploit API. `nexploit-cli` requires Node v12 to be
      installed.
    steps:
    - run:
        name: Install nexploit-cli
        command: |
          if which npm > /dev/null
          then
            if which nexploit-cli > /dev/null
              then
                echo "nexploit-cli is already installed"
              else
                npm config set registry http://registry.npmjs.org/
                npm install @neuralegion/nexploit-cli -g
              fi
          else
            echo "You need to install Node v12"
            exit 1
          fi

  new-scan-curl:
    description: Start a new Nexploit scan using just a curl
    parameters:
      api_key:
        type: env_var_name
        default: NEXPLOIT_API_KEY
        description: 'Api Key. You can get it on "Organization" tab in
        Nexploit app'
      scan_name:
        type: string
        description: Name for a scan
      hostname:
        type: string
        default: https://nexploit.app
        description: Just leave the default value unless you use a special solution
      fileId:
        type: string
        default: ''
        description: |-
          Get it with the help of curl `curl -X POST "https://nexploit.app/api/v1/files?discard=true" -H "Content-Type: multipart/form-data" -H "Authorization: Api-Key yufn0f6.yourapikeykuj069zopv0b1i" -F "har=@/path/to/the/file.har"
          `. This command will return you an id for the File ID field.
      protocol:
        type: enum
        enum:
          - http
          - websocket
      discovery_types:
        description: 'Array. Can be: "archive", "crawler", "oas". Specify
        separated by commas and every item in quotes'
        default: '"archive"'
        type: string
      hosts_filter:
        description: 'Array. Specify separated by commas and every item in quotes'
        default: ''
        type: string
      crawler_urls:
        description: 'Crawler URLs. Specify separated by commas and every item in quotes'
        default: ''
        type: string
      module:
        type: enum
        default: core
        enum:
          - core
          - exploratory
      type:
        type: enum
        default: appscan
        enum:
          - appscan
          - protoscan
    steps:
      - run:
          command: |-
            curl "<< parameters.hostname >>/api/v1/scans" \
            -H "Content-Type: application/json" \
            -H "Authorization: Api-Key $<< parameters.api_key >>" \
            -d '{
              "name": "<< parameters.scan_name >>",
              "protocol": "<< parameters.protocol >>",
              "type": "<< parameters.type >>",
              "discoveryTypes": [<< parameters.discovery_types >>],
              <<# parameters.fileId >>"fileId": "<< parameters.fileId >>",<</ parameters.fileId >>
              <<# parameters.crawler_urls >>"crawlerUrls": "<< parameters.crawler_urls >>",<</ parameters.crawler_urls >>
              "hostsFilter": [<< parameters.hosts_filter >>],
              "module": "<< parameters.module >>"
              }'

  new-scan:
    description: 'Start a new Nexploit scan using nexploit-cli. Requires npm'
    parameters:
      api_key:
        type: env_var_name
        default: NEXPLOIT_API_KEY
        description: 'Api Key. You can get it on "Organization" tab in
        Nexploit app'
      scan_name:
        type: string
        description: Name for a scan
      protocol:
        type: enum
        enum:
          - http
          - websocket
      archive:
        type: string
        default: ''
        description: Path to the archive
      hostname:
        type: string
        default: https://nexploit.app
        description: Just leave the default value unless you use a special solution
      type:
        type: enum
        default: appscan
        enum:
          - appscan
          - protoscan
      discovery_types:
        description: 'Array. Can be: "archive", "crawler", "oas". Specify
        separated by commas and every item in quotes'
        default: '"archive"'
        type: string
      crawlers:
        description: 'Crawler URLs. Specify separated by commas without spaces'
        default: ''
        type: string
      host_filters:
        description: 'Array. Specify separated by commas without spaces'
        default: ''
        type: string
      headers:
        description: 'Array. Specify separated by semicolons without spaces'
        default: ''
        type: string
    steps:
    - run:
        command: >
          crawlers="<< parameters.crawlers >>"

          crawlers_list=`echo "--crawler=${crawlers//,/" --crawler="}"`

          echo $crawlers_list

          host_filters="<< parameters.host_filters >>"

          host_filters_list=`echo "--host-filter=${host_filters//,/" --host-filter="}"`

          echo $host_filters_list

          headers="<< parameters.headers >>"

          headers_list=`echo "--header=${headers//;/" --header="}"`

          echo $headers_list

          command="nexploit-cli scan:run
          --name=<< parameters.scan_name >>
          <<# parameters.archive >>--archive=<< parameters.archive >><</parameters.archive >>
          --protocol=<< parameters.protocol >>
          --api-key=$<< parameters.api_key >>
          --api=<< parameters.hostname >>
          --type=<< parameters.type >>
          --discard=false
          --discovery=<< parameters.discovery_types >>
          <<# parameters.crawlers >>$crawlers_list<</parameters.crawlers >>
          <<# parameters.host_filters >>$host_filters_list<</parameters.host_filters >>
          <<# parameters.headers >>$headers_list<</parameters.headers >>"

          echo $command

          scan_id=`($command)`

          echo "Your scan is available on << parameters.hostname >>/scans/$scan_id"

  polling-status:
    description: Allows to poll status and wait for issues. 
    parameters:
      api_key:
        type: env_var_name
        default: NEXPLOIT_API_KEY
        description: 'Api Key. You can get it on "Organization" tab in
        Nexploit app'
      scan_id:
        type: string
        description: Scan id to rerun
      interval:
        type: integer
        default: 5000
        description: |
          Period of time between the end of a timeout period or completion of
          a scan status request, and the next request for status
      hostname:
        type: string
        default: https://nexploit.app
        description: Just leave the default value unless you use a special solution
      failure_on:
        type: enum
        default: first-issue
        enum:
        - first-issue
        - first-medium-severity-issue
        - first-high-severity-issue
    steps:
    - run:
        command: |
          nexploit-cli scan:polling << parameters.scan_id >>  \
            --failure-on=<< parameters.failure_on >>          \
            --api-key=$<< parameters.api_key >>               \
            --api=<< parameters.hostname >>                   \
            --interval=<< parameters.interval >>

  retest-scan:
    description: >
      Perhaps the most convenient way to start a scan. Start a new scan, using
      web UI at https://nexploit.app. You can get scan id from address bar.
      You should use this id to rerun the scan.
    parameters:
      api_key:
        type: env_var_name
        default: NEXPLOIT_API_KEY
        description: 'Api Key. You can get it on "Organization" tab in
        Nexploit app'
      scan_id:
        type: string
        description: Scan id to rerun
      hostname:
        type: string
        default: https://nexploit.app
        description: Just leave the default value unless you use a special solution
    steps:
    - run:
        command: |
          nexploit-cli                          \
          scan:retest << parameters.scan_id >>  \
          --api-key=$<< parameters.api_key >>   \
          --api=<< parameters.hostname >>

executors:
  default:
    description: >
      Default environment for Nexploit. This is a small Alpine-based Docker
      image with a low resource class.
    parameters:
      image:
        type: string
        default: neuralegion/nexploit-cli
        description: Docker image name
      tag:
        type: string
        default: latest
        description: Docker image tag
    resource_class: small
    docker:
      - image: <<parameters.image>>:<<parameters.tag>>

jobs:
  retest-and-poll:
    description: >
      Restart scan and poll its status
    executor:
      name: default
      image: << parameters.executor_image >>
      tag: << parameters.executor_tag >>
    parameters:
      api_key:
        type: env_var_name
        default: NEXPLOIT_API_KEY
        description: 'Api Key. You can get it on "Organization" tab in
        Nexploit app'
      scan_id:
        type: string
        description: Scan id to rerun
      hostname:
        type: string
        default: https://nexploit.app
        description: Just leave the default value unless you use a special solution
      interval:
        type: integer
        default: 5000
        description: >
          Period of time between the end of a timeout period or completion of
          a scan status request, and the next request for status
      failure_on:
        type: enum
        default: first-issue
        enum:
        - first-issue
        - first-medium-severity-issue
        - first-high-severity-issue
      executor_image:
        type: string
        default: neuralegion/nexploit-cli
        description: Docker image name
      executor_tag:
        type: string
        default: latest
        description: Docker image tag
    steps:
      - run:
          name: Retest an exesting scan and wait for results
          command: |
            scan_id=$(nexploit-cli scan:retest << parameters.scan_id >> \
              --api-key=$<< parameters.api_key >>                       \
              --api=<< parameters.hostname >>)
            echo "Your scan is available on << parameters.hostname >>/scans/$scan_id"
            echo "Waiting for issues..."
            nexploit-cli scan:polling $scan_id                  \
              --failure-on=<< parameters.failure_on >>          \
              --api-key=$<< parameters.api_key >>               \
              --api=<< parameters.hostname >>                   \
              --interval=<< parameters.interval >>