如何将 minIO（例如 Nmap、Nikto、Sslyze、Zap）的扫描输出上传到 OWASP DefectDojo

Question

我在将 minIO securecodebox 输出结果上传到 OWASP DefectDojo 时遇到问题。

错误截图https://drive.google.com/file/d/1PqVOazjr7r_1oMPf6SQsh8_iPFgnqkjC/view?usp=sharing

我尝试按照这些步骤操作 https://github.com/DefectDojo/django-DefectDojo/blob/dev/readme-docs/KUBE.NETES.md然后https://docs.securecodebox.io/docs/hooks/defectdojo/

这是扫描仪的链接https://github.com/secureCodeBox/secureCodeBox/tree/main/scanners

错误：

2022-03-07 07:23:54 信息 DefectDojoPersistenceProvider:35 - 下载扫描结果提供程序 2022-03-07 07:23:56 信息 DefectDojoPersistenceProvider:39 - 将结果上传到 DefectDojo，地址： http://defectdojo.default.minikube .local:8080/ tDojo at: http://defectdojo.default.minikube.local:8080/线程“main”中的异常 org.springframework.web.client.ResourceAccessException：GET 请求“http:/ /defectdojo.default.minikube.locarror 对“http://defectdojo.default.minikube.local:8080/api/v2/users/”的 GET 请求：defectdojo.default.minikube.local；嵌套异常是 java.net。 UnknownHostException: defectdojo.default.minikube.local 在 org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:785) 在 org.springframework.web.client.RestTemplate.execute(RestTemplate.88213284867988:785) .java:151) 在 org.springframework.web.client.RestTemplate.e xchange(RestTemplate.java:621) ch(GenericDefectDojoService.java:167) at io.securecodebox.persistence.defectdojo.service.GenericDefectDojoService.intechUnique(GenericDefectDojoService.java:187)rnalSearch(GenericDefectDojoService.java:151) ionedEngagementsStrategy.java:82 ) at io.securecodebox.persistence.defectdojo.service.GenericDefectDojoService.search(GenericDefectDojoService.java:167) at io.securecodebox.persistence.defectdojo.service.GenericDefectDojoService.searchUnique(GenericDefectDojoService.java:187) at io.securecodebox.persistence. strategies.VersionedEngagementsStrategy.run(VersionedEngagementsStrategy.java:82) at io.securecodebox.persistence.DefectDojoPersistenceProvider.main(DefectDojoPersistenceProvider.java:42) Caused by: java.net.UnknownHostException: defectdojo.default.minikube.local at java.base/ java.net.AbstractPlain SocketImpl.connect(AbstractPlainSocketImpl.java:229) at java.base/java.net.Socket.connect(Socket.java:609) at java.base/java.net.Socket.connect(Socket.java:558) at java .base/sun.net.NetworkClient.doConnect(NetworkClient.java:182) 在 java.base/sun.net.www.http.HttpClient.openServer(HttpClient.java:474) 在 88924.net/sun/8888 .http.HttpClient.openServer(HttpClient.java:569) at java.base/sun.net.www.http.HttpClient.(HttpClient.java:242) at java.base/sun.net.www.http.HttpClient. New(HttpClient.java:341) at java.base/sun.net.www.http.HttpClient.New(HttpClient.java:362) at java.base/sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient( HttpURLConnection.java:1253) 在 java.base/sun.net.www.protocol.http.HttpURLConnection .plainConnect0(HttpURLConnection.java:1187) at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1081) at java.base/sun.net.www.protocol.http.HttpURLConnection .connect(HttpURLConnection.java:1015) at org.springframework.http.client.SimpleBufferingClientHttpRequest.executeInternal(SimpleBufferingClientHttpRequest.java:76) at org.springframework.http.client.AbstractBufferingClientHttpRequest.executeInternal(AbstractBufferingClientHttpRequest.java:48) at org. springframework.http.client.AbstractClientHttpRequest.execute（AbstractClientHttpRequest.java:66）在org.springframework.web.client.RestTemplate.doExecute（RestTemplate.java8:66）...88:77

感谢您的回复！

Answer 1

有一个专用的 DefectDojo Hook 可以为您完成。 您只需要安装在具有一些基本配置的集群上。

安装 DefectDojo persistenceProvider 挂钩会将 ReadAndWrite 挂钩添加到您的命名空间。

kubectl create secret generic defectdojo-credentials --from-literal="username=admin" --from-literal="apikey=08b7..."

helm 升级 --install dd secureCodeBox/persistence-defectdojo
--set="defectdojo.url=https://defectdojo-django.default.svc"

该挂钩会自动将扫描结果导入到 DefectDojo 中。 如果参与不存在，挂钩将创建参与（CI/CD 参与）和它所需的所有对象（产品和产品类型）。 然后，该挂钩将从 DefectDojo 中提取导入的信息，并使用它们替换 secureCodeBox 中的发现。

更多https://docs.securecodebox.io/docs/hooks/defectdojo