testing-security

What this skill does

# testing-security

## Purpose
This skill automates security testing by integrating DAST tools (OWASP ZAP, Nuclei), SAST tools (Semgrep, Bandit), SCA tools (Snyk, Trivy), and secrets scanners (detect-secrets, TruffleHog) to identify vulnerabilities in code, applications, and secrets.

## When to Use
Use this skill during CI/CD pipelines, before deployments, or for periodic audits; ideal for projects with web apps, APIs, or codebases in languages like Python, Java, or JavaScript where security flaws could lead to breaches.

## Key Capabilities
- DAST: Run OWASP ZAP for active scanning of web apps, detecting issues like XSS or SQLi; use Nuclei for custom vulnerability templates.
- SAST: Execute Semgrep for pattern-based code analysis (e.g., YAML rulesets) or Bandit for Python-specific flaws like insecure imports.
- SCA: Leverage Snyk to scan dependencies for known CVEs via SBOM analysis; use Trivy for container image scanning with vulnerability databases.
- Secrets Detection: Apply detect-secrets to scan files for patterns like API keys; use TruffleHog for Git history scans to find exposed secrets.
- Integration: Combine tools in a single workflow, e.g., run SAST on code changes and DAST on staging environments.

## Usage Patterns
Always configure tools via environment variables for authentication (e.g., `$ZAP_API_KEY` for OWASP ZAP, `$SNYK_TOKEN` for Snyk). Start with a baseline scan on new projects, then automate in scripts.

- Pattern 1: For CI/CD, trigger SAST on pull requests and DAST on builds; example: Use GitHub Actions to run Semgrep on diffed files.
- Pattern 2: For local testing, chain tools sequentially—first run Trivy on Docker images, then Nuclei on URLs.
- Example 1: To scan a Python repo for SAST and secrets: Install tools, run Bandit on files, then detect-secrets; output results to a JSON report for parsing.
- Example 2: For a web app, perform DAST: Start OWASP ZAP in daemon mode, use `zap-cli` to scan a URL, and follow with Nuclei for specific exploits.

## Common Commands/API
Use these exact commands in scripts or terminals; ensure dependencies are installed (e.g., via pip or Docker).

- OWASP ZAP (DAST): Start with `zap.sh -daemon -port 8080`, then scan via `zap-cli -p 8080 quick-scan --spider https://target.com --report html`. API endpoint: POST to `/JSON/core/action/newSession/` with `$ZAP_API_KEY`.
- Nuclei (DAST): Run `nuclei -t templates/ -u https://target.com -o results.txt`; use config file like `nuclei-config.yaml` with severity levels.
- Semgrep (SAST): Execute `semgrep --config p/default --lang python .`; customize with a `.semgrep.yml` file: `rules: - id: no-os-system patterns: - pattern: os.system(...)`.
- Bandit (SAST): Command: `bandit -r /path/to/code -f json`; ignore paths via `-x tests/`.
- Snyk (SCA): Authenticate with `$SNYK_TOKEN`, then `snyk test --file=requirements.txt`; API: GET `https://snyk.io/api/v1/org/{orgId}/projects` for project lists.
- Trivy (SCA): Scan image: `trivy image myimage:latest --exit-code 1 --severity CRITICAL`; config via `.trivy.yaml` with `ignoreUnfixed: true`.
- detect-secrets (Secrets): Run `detect-secrets scan > .secrets.baseline`; use with Git hook: `detect-secrets hook --baseline .secrets.baseline`.
- TruffleHog (Secrets): Command: `trufflehog git https://github.com/repo --since-commit HEAD~1`; filter with `--regex` for patterns.

## Integration Notes
Integrate via scripts or orchestration tools like Jenkins or GitHub Actions; pass outputs as JSON for chaining. For auth, set env vars like `$TRIVY_USERNAME` and `$TRIVY_PASSWORD`. Use Docker images (e.g., `owasp/zap2docker-stable`) for isolated runs. Config formats: YAML for Semgrep rules (e.g., `{ patterns: [pattern: "regex"] }`), JSON for Snyk reports. Ensure tools are version-pinned (e.g., Semgrep v0.100.0) to avoid breaking changes.

## Error Handling
Check exit codes after each command (e.g., Semgrep returns non-zero on findings); parse errors from stdout, like OWASP ZAP's JSON responses for "error" keys. Common issues: Network errors in DAST—retry with `zap-cli --retries 3`; authentication failures—verify env vars (e.g., if `$SNYK_TOKEN` is invalid, output "Auth error"). Log all outputs to files and handle via try-catch in scripts, e.g., in Bash: `zap-cli quick-scan || echo "Scan failed: $?" >> error.log`. For API calls, check HTTP status codes (e.g., 401 for unauthorized).

## Graph Relationships
- Related to: "testing" cluster (e.g., links to unit-testing or integration-testing skills for combined workflows).
- Depends on: OWASP ZAP for DAST, Semgrep for SAST.
- Integrates with: Snyk API for SCA, TruffleHog for secrets in version control systems.