xx
2 years ago
parent
cb275ec0b1
commit
ee6ec18dd5
@ -0,0 +1,123 @@ |
|||||||
|
## Antenna <https://github.com/wuba/Antenna> |
||||||
|
<!--auto_detail_badge_begin_0b490ffb61b26b45de3ea5d7dd8a582e--> |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
<!--auto_detail_badge_end_fef74f2d7ea73fcc43ff78e05b1e7451--> |
||||||
|
|
||||||
|
|
||||||
|
Antenna是58同城安全团队打造的一款辅助安全从业人员辅助验证网络中多种漏洞是否存在以及可利用性的工具。其基于带外应用安全测试( |
||||||
|
OAST)通过任务的形式，将不同漏洞场景检测能力通过插件的形式进行集合，通过与目标进行Out-of-bind的数据通信方式进行辅助检测。 |
||||||
|
|
||||||
|
## Antenna的目标 |
||||||
|
|
||||||
|
我们绝不仅仅只是将Antenna做成一款只能监听DNS、HTTP等协议来简单判断无回显类型漏洞的工具，我们的目标是尝试在良好使用体验的基础上支持高度灵活的自定义组件能力，满足用户通过Antenna探索并实现各种应用安全漏洞场景的辅助检测。尽可能得实现通过Antenna这款产品降低各种安全漏洞场景的检测成本。 |
||||||
|
|
||||||
|
## 相关网站 |
||||||
|
|
||||||
|
博客(已开放)：[Antenna 博客](http://blog.antenna.cool/docs/intro) |
||||||
|
|
||||||
|
演示平台(暂时关闭)：[演示平台](http://jiemuzu.cn) |
||||||
|
|
||||||
|
漏洞靶场(已支持docker部署,docker-compose文件在项目docker目录中)：[lcttty/antenna-range:0.0.1](https://github.com/wuba/Antenna/blob/main/docker/docker-compose-range.yaml) |
||||||
|
|
||||||
|
## Antenna_Inside计划 |
||||||
|
|
||||||
|
在我们开发Antenna时，就希望能够支持现有市场上流行的漏洞扫描工具漏洞结果回调与主动查询 |
||||||
|
,所以我们推出了CallBack与OpenAPI。为了让我们的这两个模块能够更加灵活与优雅。我们决定发起 |
||||||
|
Antenna_Inside计划，如果您是使用扫描工具的用户或者作者请联系我们，我们会无条件支持您的项目与 |
||||||
|
需求，帮助Antenna更方便的与漏洞扫描流程打通。如果您有推荐打通的项目，也可以在issue中提出来 |
||||||
|
|
||||||
|
已加入Antenna_Inside项目与进度 |
||||||
|
|
||||||
|
| 项目名称 | 项目地址 | 项目进度 | |
||||||
|
|------------|----------------------------------------------------------------------------|------| |
||||||
|
| EasyPen | [https://github.com/lijiejie/EasyPen](https://github.com/lijiejie/EasyPen) | 正在对接 | |
||||||
|
|
||||||
|
|
||||||
|
## 近期使用疑问解答 |
||||||
|
|
||||||
|
#### 1、关于docker部署发现平台配置保存后不能及时更新的问题 |
||||||
|
|
||||||
|
回答：更新完配置需在宿主机重新运行命令 **docker-compose restart** 后配置才能更新 |
||||||
|
不需要重启mysql容器 |
||||||
|
|
||||||
|
#### 2、关于各类组件的使用说明以及能否再详细的进行说明自定义组件开发教程 |
||||||
|
|
||||||
|
回答：文章将在Antenna博客不定时更新，基础文章已有，后续详细的也会有的，作者在加班加点的写，绝不会让各位师傅等太久 |
||||||
|
|
||||||
|
#### 3、运行docker-compose命令后镜像构建时间过长 |
||||||
|
|
||||||
|
回答：可能是您的服务器在境外，可将Dockerfile中替换镜像源的命令注释掉 |
||||||
|
|
||||||
|
#### 4、镜像部署总是遇到各种权限不允许的错误 |
||||||
|
|
||||||
|
回答：可将docker下列内容删除 |
||||||
|
|
||||||
|
```dockerfile |
||||||
|
RUN addgroup --system antenna \ |
||||||
|
&& adduser --system --ingroup antenna antenna |
||||||
|
|
||||||
|
USER antenna |
||||||
|
``` |
||||||
|
|
||||||
|
#### 5、其他问题 |
||||||
|
|
||||||
|
如果您遇到了其他问题可查阅项目issue进行寻找相关解决方案，如果发现并没有其他人遇到和您相关的问题，请新建issue， |
||||||
|
作者会及时回答您的疑问 |
||||||
|
|
||||||
|
|
||||||
|
## 相关教程链接 |
||||||
|
### 最新公告 |
||||||
|
|
||||||
|
Antenna 最新chrome扩展 chrome-tools(试用版)发布[Antenna-tools 使用教程](http://blog.antenna.cool/blog/antenna_plugin) |
||||||
|
|
||||||
|
v1.0版本发布公告及使用要点:[Antenna V1.0 发布公告](http://blog.antenna.cool/blog/v1.0) |
||||||
|
|
||||||
|
### 关于部署 |
||||||
|
基础部署教程:[安装部署](http://blog.antenna.cool/docs/intro) |
||||||
|
|
||||||
|
隐匿部署教程：[关于Antenna的隐匿性部署](http://blog.antenna.cool/blog/%20%20Secrecy) |
||||||
|
|
||||||
|
前后端分离部署 [Antenna的前后端分离部署](http://blog.antenna.cool/blog/client_server) |
||||||
|
|
||||||
|
### 关于配置 |
||||||
|
|
||||||
|
基础配置教程:[基础配置教程](http://blog.antenna.cool/docs/%E5%85%B3%E4%BA%8E%E9%85%8D%E7%BD%AE/config) |
||||||
|
|
||||||
|
域名配置及DNS相关配置:[域名配置及阿里云dns服务修改教程](http://blog.antenna.cool/docs/%E5%85%B3%E4%BA%8E%E9%85%8D%E7%BD%AE/DNS) |
||||||
|
|
||||||
|
开通邮箱通知以及邮箱授权码申请教程:[QQ邮箱授权码申请教程](https://service.mail.qq.com/cgi-bin/help?subtype=1&id=28&no=1001256) |
||||||
|
|
||||||
|
### 关于任务 |
||||||
|
|
||||||
|
任务基础使用教程:[如何简单的使用任务](http://blog.antenna.cool/docs/%E5%85%B3%E4%BA%8E%E4%BB%BB%E5%8A%A1/task) |
||||||
|
|
||||||
|
### 关于组件 |
||||||
|
|
||||||
|
组件基础使用教程:[Antenna的灵魂-组件Template](http://blog.antenna.cool/docs/%E5%85%B3%E4%BA%8E%E7%BB%84%E4%BB%B6/template) |
||||||
|
|
||||||
|
xss 组件使用教程:[xss组件使用教程](http://blog.antenna.cool/docs/%E5%85%B3%E4%BA%8E%E7%BB%84%E4%BB%B6/xss) |
||||||
|
|
||||||
|
组件开发教程:[如何编写Antenna组件](http://blog.antenna.cool/docs/%E5%85%B3%E4%BA%8E%E7%BB%84%E4%BB%B6/template_demo) |
||||||
|
|
||||||
|
### 关于OPEN_API与CallBack |
||||||
|
|
||||||
|
OPEN_API与CallBack使用教程:[关于OPEN_API与CallBack](http://blog.antenna.cool/docs/api_back) |
||||||
|
|
||||||
|
<!--auto_detail_active_begin_e1c6fb434b6f0baf6912c7a1934f772b--> |
||||||
|
## 项目相关 |
||||||
|
|
||||||
|
|
||||||
|
## 最近更新 |
||||||
|
|
||||||
|
#### [v1.1] - 2022-09-16 |
||||||
|
|
||||||
|
**更新** |
||||||
|
- 增加 OpenAPI 的部分接口 |
||||||
|
- 修复了一些 bug |
||||||
|
- 支持 chrome 扩展 chrome-tools |
||||||
|
|
||||||
|
<!--auto_detail_active_end_f9cf7911015e9913b7e691a7a5878527--> |
||||||
@ -0,0 +1,172 @@ |
|||||||
|
## appshark <https://github.com/bytedance/appshark> |
||||||
|
<!--auto_detail_badge_begin_0b490ffb61b26b45de3ea5d7dd8a582e--> |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
<!--auto_detail_badge_end_fef74f2d7ea73fcc43ff78e05b1e7451--> |
||||||
|
|
||||||
|
## Document Index |
||||||
|
- [1.overview](doc/zh/overview.md) |
||||||
|
- [2.startup](doc/zh/startup.md) |
||||||
|
- [3.how to write rules](doc/zh/how_to_write_rules.md) |
||||||
|
- [4.how to find compliance problems use appshark](doc/zh/how_to_find_compliance_problem_use_appshark.md) |
||||||
|
- [5.a path traversal game](doc/zh/path_traversal_game.md) |
||||||
|
- [6.argument](doc/zh/argument.md) |
||||||
|
- [7.engine config](doc/zh/EngineConfig.md) |
||||||
|
- [8.result](doc/zh/result.md) |
||||||
|
- [9.faq](doc/zh/faq.md) |
||||||
|
|
||||||
|
|
||||||
|
Appshark is a static taint analysis platform to scan vulnerabilities in an Android app. |
||||||
|
|
||||||
|
## Prerequisites |
||||||
|
|
||||||
|
Appshark requires a specific version of JDK |
||||||
|
-- [JDK 11](https://www.oracle.com/java/technologies/javase/jdk11-archive-downloads.html). After testing, it does not |
||||||
|
work on other LTS versions, JDK 8 and JDK 16, due to the dependency compatibility issue. |
||||||
|
|
||||||
|
## Building/Compiling AppShark |
||||||
|
|
||||||
|
We assume that you are working in the root directory of the project repo. You can build the whole project with |
||||||
|
the [gradle](https://gradle.org/) tool. |
||||||
|
|
||||||
|
```shell |
||||||
|
$ ./gradlew build -x test |
||||||
|
``` |
||||||
|
|
||||||
|
After executing the above command, you will see an artifact file `AppShark-0.1.1-all.jar` in the directory `build/libs`. |
||||||
|
|
||||||
|
## Running AppShark |
||||||
|
|
||||||
|
Like the previous step, we assume that you are still in the root folder of the project. You can run the tool with |
||||||
|
|
||||||
|
```shell |
||||||
|
$ java -jar build/libs/AppShark-0.1.1-all.jar config/config.json5 |
||||||
|
``` |
||||||
|
|
||||||
|
The `config.json5` has the following configuration contents. |
||||||
|
|
||||||
|
```JSON |
||||||
|
{ |
||||||
|
"apkPath": "/Users/apks/app1.apk", |
||||||
|
"out": "out", |
||||||
|
"rules": "unZipSlip.json", |
||||||
|
"maxPointerAnalyzeTime": 600 |
||||||
|
} |
||||||
|
``` |
||||||
|
|
||||||
|
Each JSON field is explained below. |
||||||
|
|
||||||
|
- apkPath: the path of the apk file to analyze |
||||||
|
- out: the path of the output directory |
||||||
|
- rules: the path(s) of the rule file(s), can be more than 1 rules |
||||||
|
- maxPointerAnalyzeTime: the timeout duration in seconds set for the analysis started from an entry point |
||||||
|
- debugRule: specify the rule name that enables logging for debugging |
||||||
|
|
||||||
|
If you provide a configuration JSON file which sets the output path as `out` in the project root directory, you will |
||||||
|
find the result file `out/results.json` after running the analysis. |
||||||
|
|
||||||
|
## Interpreting the Results |
||||||
|
|
||||||
|
Below is an example of the `results.json`. |
||||||
|
|
||||||
|
```JSON |
||||||
|
{ |
||||||
|
"AppInfo": { |
||||||
|
"AppName": "test", |
||||||
|
"PackageName": "net.bytedance.security.app", |
||||||
|
"min_sdk": 17, |
||||||
|
"target_sdk": 28, |
||||||
|
"versionCode": 1000, |
||||||
|
"versionName": "1.0.0" |
||||||
|
}, |
||||||
|
"SecurityInfo": { |
||||||
|
"FileRisk": { |
||||||
|
"unZipSlip": { |
||||||
|
"category": "FileRisk", |
||||||
|
"detail": "", |
||||||
|
"model": "2", |
||||||
|
"name": "unZipSlip", |
||||||
|
"possibility": "4", |
||||||
|
"vulners": [ |
||||||
|
{ |
||||||
|
"details": { |
||||||
|
"position": "<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolderFix1(java.lang.String,java.lang.String)>", |
||||||
|
"Sink": "<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolderFix1(java.lang.String,java.lang.String)>->$r31", |
||||||
|
"entryMethod": "<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void f()>", |
||||||
|
"Source": "<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolderFix1(java.lang.String,java.lang.String)>->$r3", |
||||||
|
"url": "/Volumes/dev/zijie/appshark-opensource/out/vuln/1-unZipSlip.html", |
||||||
|
"target": [ |
||||||
|
"<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolderFix1(java.lang.String,java.lang.String)>->$r3", |
||||||
|
"pf{obj{<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolderFix1(java.lang.String,java.lang.String)>:35=>java.lang.StringBuilder}(unknown)->@data}", |
||||||
|
"<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolderFix1(java.lang.String,java.lang.String)>->$r11", |
||||||
|
"<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolderFix1(java.lang.String,java.lang.String)>->$r31" |
||||||
|
] |
||||||
|
}, |
||||||
|
"hash": "ec57a2a3190677ffe78a0c8aaf58ba5aee4d2247", |
||||||
|
"possibility": "4" |
||||||
|
}, |
||||||
|
{ |
||||||
|
"details": { |
||||||
|
"position": "<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolder(java.lang.String,java.lang.String)>", |
||||||
|
"Sink": "<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolder(java.lang.String,java.lang.String)>->$r34", |
||||||
|
"entryMethod": "<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void f()>", |
||||||
|
"Source": "<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolder(java.lang.String,java.lang.String)>->$r3", |
||||||
|
"url": "/Volumes/dev/zijie/appshark-opensource/out/vuln/2-unZipSlip.html", |
||||||
|
"target": [ |
||||||
|
"<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolder(java.lang.String,java.lang.String)>->$r3", |
||||||
|
"pf{obj{<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolder(java.lang.String,java.lang.String)>:33=>java.lang.StringBuilder}(unknown)->@data}", |
||||||
|
"<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolder(java.lang.String,java.lang.String)>->$r14", |
||||||
|
"<net.bytedance.security.app.pathfinder.testdata.ZipSlip: void UnZipFolder(java.lang.String,java.lang.String)>->$r34" |
||||||
|
] |
||||||
|
}, |
||||||
|
"hash": "26c6d6ee704c59949cfef78350a1d9aef04c29ad", |
||||||
|
"possibility": "4" |
||||||
|
} |
||||||
|
], |
||||||
|
"wiki": "", |
||||||
|
"deobfApk": "/Volumes/dev/zijie/appshark-opensource/app.apk" |
||||||
|
} |
||||||
|
} |
||||||
|
}, |
||||||
|
"DeepLinkInfo": { |
||||||
|
}, |
||||||
|
"HTTP_API": [ |
||||||
|
], |
||||||
|
"JsBridgeInfo": [ |
||||||
|
], |
||||||
|
"BasicInfo": { |
||||||
|
"ComponentsInfo": { |
||||||
|
}, |
||||||
|
"JSNativeInterface": [ |
||||||
|
] |
||||||
|
}, |
||||||
|
"UsePermissions": [ |
||||||
|
], |
||||||
|
"DefinePermissions": { |
||||||
|
}, |
||||||
|
"Profile": "/Volumes/dev/zijie/appshark-opensource/out/vuln/3-profiler.json" |
||||||
|
} |
||||||
|
|
||||||
|
``` |
||||||
|
|
||||||
|
# License |
||||||
|
|
||||||
|
AppShark is licensed under the [APACHE LICENSE, VERSION 2.0](http://www.apache.org/licenses/LICENSE-2.0) |
||||||
|
|
||||||
|
|
||||||
|
<!--auto_detail_active_begin_e1c6fb434b6f0baf6912c7a1934f772b--> |
||||||
|
## 项目相关 |
||||||
|
|
||||||
|
|
||||||
|
## 最近更新 |
||||||
|
|
||||||
|
#### [v0.1.1] - 2022-09-16 |
||||||
|
|
||||||
|
**更新** |
||||||
|
- 增加 APIMode 模式 |
||||||
|
- 增加 camile.json 规则 |
||||||
|
|
||||||
|
<!--auto_detail_active_end_f9cf7911015e9913b7e691a7a5878527--> |
||||||
@ -0,0 +1,270 @@ |
|||||||
|
## murphysec <https://github.com/murphysecurity/murphysec> |
||||||
|
<!--auto_detail_badge_begin_0b490ffb61b26b45de3ea5d7dd8a582e--> |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
<!--auto_detail_badge_end_fef74f2d7ea73fcc43ff78e05b1e7451--> |
||||||
|
|
||||||
|
中文 | [EN](README.md) |
||||||
|
|
||||||
|
墨菲安全的 **CLI 工具**，用于在命令行检测指定目录代码的依赖安全问题，也可以基于 CLI 工具实现在 CI 流程的检测。 |
||||||
|
|
||||||
|
|
||||||
|
## 功能 |
||||||
|
1. 分析项目使用的依赖信息，包含直接和间接依赖 |
||||||
|
2. 检测项目依赖存在的已知漏洞信息 |
||||||
|
|
||||||
|
|
||||||
|
### 效果截图 |
||||||
|
|
||||||
|
- CLI 运行结果 |
||||||
|
|
||||||
|
<img alt="cli output" src="https://github.com/murphysecurity/murphysec/raw/master/assets/cli.png" width="80%"> |
||||||
|
|
||||||
|
- 检测结果页面 |
||||||
|
|
||||||
|
<img alt="scan result" src="https://github.com/murphysecurity/murphysec/raw/master/assets/scan-result.png" width="80%"> |
||||||
|
<img alt="scan result" src="https://github.com/murphysecurity/murphysec/raw/master/assets/scan-detail-result.png" width="80%"> |
||||||
|
|
||||||
|
## 目录 |
||||||
|
|
||||||
|
1. [支持的语言](#支持的语言) |
||||||
|
2. [工作原理](#工作原理) |
||||||
|
3. [使用场景](#使用场景) |
||||||
|
4. [使用步骤](#使用步骤) |
||||||
|
5. [命令介绍](#命令介绍) |
||||||
|
6. [交流和问题反馈](#交流和问题反馈) |
||||||
|
7. [开源协议](#开源协议) |
||||||
|
|
||||||
|
## 支持的语言 |
||||||
|
|
||||||
|
目前支持 Java、JavaScript、Golang、Python、PHP、C#、Ruby、Objective-C、.NET 语言项目的检测，后续会逐渐支持其他的开发语言。 |
||||||
|
|
||||||
|
<table> |
||||||
|
<tr> |
||||||
|
<th>语言</th> |
||||||
|
<th>包管理工具</th> |
||||||
|
<th>所需文件</th> |
||||||
|
</tr> |
||||||
|
<tr > |
||||||
|
<td rowspan="2">Java</td> |
||||||
|
<td>Maven</td> |
||||||
|
<td>pom.xml</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
<tr> |
||||||
|
<td>Gradle</td> |
||||||
|
<td>build.gradle, build.gradle.kts</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
|
||||||
|
<tr > |
||||||
|
<td>Go</td> |
||||||
|
<td>Go Modules</td> |
||||||
|
<td>go.mod</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
|
||||||
|
<tr > |
||||||
|
<td rowspan="2">JavaScript</td> |
||||||
|
<td>NPM</td> |
||||||
|
<td>package.json, package-lock.json</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
<tr> |
||||||
|
<td>Yarn</td> |
||||||
|
<td>yarn.lock, package.json</td> |
||||||
|
|
||||||
|
|
||||||
|
<tr > |
||||||
|
<td rowspan="2">Python</td> |
||||||
|
<td>pip</td> |
||||||
|
<td>requirements.txt</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
<tr> |
||||||
|
<td>Poetry</td> |
||||||
|
<td>poetry.lock</td> |
||||||
|
|
||||||
|
<tr > |
||||||
|
<td>PHP</td> |
||||||
|
<td>Composer</td> |
||||||
|
<td>composer.lock</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
|
||||||
|
<tr > |
||||||
|
<td>Ruby</td> |
||||||
|
<td>Bundler</td> |
||||||
|
<td>Gemfile.lock, gems.locked</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
<tr > |
||||||
|
<td>.NET</td> |
||||||
|
<td>NuGet</td> |
||||||
|
<td>packages.lock.json</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
<tr > |
||||||
|
<td>C#</td> |
||||||
|
<td>NuGet</td> |
||||||
|
<td>packages.lock.json</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
|
||||||
|
<tr > |
||||||
|
<td>Objective-C</td> |
||||||
|
<td>Cocoapods</td> |
||||||
|
<td>Podfile.lock</td> |
||||||
|
|
||||||
|
</tr> |
||||||
|
|
||||||
|
</table> |
||||||
|
|
||||||
|
详细的支持情况可以[查看文档](https://www.murphysec.com/docs/quick-start/language-support/) |
||||||
|
|
||||||
|
## 工作原理 |
||||||
|
|
||||||
|
1. 对于使用不同语言/包管理工具的项目，墨菲安全的 CLI 工具主要采用`项目构建`或直接对`包管理文件`进行解析的方式，来准确获取到项目的依赖信息 |
||||||
|
2. 项目的依赖信息会上传到服务端，并基于墨菲安全持续维护的`漏洞知识库`来识别项目中存在安全缺陷的依赖 |
||||||
|
|
||||||
|
 |
||||||
|
|
||||||
|
> 说明：CLI 工具只会将检测项目的依赖和基本信息发送到墨菲安全服务端，用于识别存在安全缺陷的依赖，不会上传任何本地代码。 |
||||||
|
|
||||||
|
|
||||||
|
## 使用场景 |
||||||
|
1. 希望在本地环境中检测代码文件 |
||||||
|
2. 希望集成到 CI 环境中对代码项目进行检测 |
||||||
|
|
||||||
|
参考：[墨菲安全 CLI 与 Jenkins CI 的集成](https://www.murphysec.com/docs/integrations/jenkins/) |
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## 使用步骤 |
||||||
|
### 1. 安装 |
||||||
|
|
||||||
|
访问 [GitHub Releases](https://github.com/murphysecurity/murphysec/releases/latest) 页面下载最新版本的墨菲安全 CLI，或执行以下相关命令： |
||||||
|
|
||||||
|
#### 在 Linux 上安装 |
||||||
|
|
||||||
|
``` |
||||||
|
wget -q https://s.murphysec.com/install.sh -O - | /bin/bash |
||||||
|
``` |
||||||
|
|
||||||
|
#### 在 OSX 上安装 |
||||||
|
|
||||||
|
``` |
||||||
|
curl -fsSL https://s.murphysec.com/install.sh | /bin/bash |
||||||
|
``` |
||||||
|
|
||||||
|
#### 在 WINDOWS 上安装 |
||||||
|
|
||||||
|
``` |
||||||
|
powershell -Command "iwr -useb https://s.murphysec.com/install.ps1 | iex" |
||||||
|
``` |
||||||
|
|
||||||
|
### 2. 获取访问令牌 |
||||||
|
|
||||||
|
> CLI 工具需要使用墨菲安全账户的`访问令牌`进行认证才能正常使用。[访问令牌是什么？（点击查看详情）](https://www.murphysec.com/docs/faq/access-token/) |
||||||
|
|
||||||
|
|
||||||
|
进入[墨菲安全控制台](https://www.murphysec.com/control/set)，点击`个人设置`，复制页面中的`访问令牌` |
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
### 3. 认证 |
||||||
|
|
||||||
|
目前有两种认证方式可用：命令行交互认证、命令行参数认证 |
||||||
|
|
||||||
|
#### 命令行交互认证 |
||||||
|
执行`murphysec auth login`命令，粘贴访问令牌即可。 |
||||||
|
|
||||||
|
|
||||||
|
> 认证后下次使用墨菲安全 CLI 无需再次执行此操作，如果需要更换访问令牌，可以重复执行此命令来覆盖旧的访问令牌。 |
||||||
|
|
||||||
|
|
||||||
|
#### 命令行参数认证 |
||||||
|
执行检测命令时，通过增加`--token`参数指定访问令牌进行认证 |
||||||
|
|
||||||
|
### 4. 检测 |
||||||
|
|
||||||
|
使用`murphysec scan`命令进行检测，可以执行以下命令： |
||||||
|
|
||||||
|
``` bash |
||||||
|
murphysec scan [your-project-path] |
||||||
|
``` |
||||||
|
|
||||||
|
可用的参数 |
||||||
|
- `--token`：指定访问令牌 |
||||||
|
- `--log-level`：指定命令行输出流打印的日志级别，默认不打印日志，可选参数为`silent`、`error`、`warn`、`info`、`debug` |
||||||
|
- `--json`：指定检测的结果输出为json，默认不展示结果详情 |
||||||
|
|
||||||
|
|
||||||
|
### 5. 查看结果 |
||||||
|
|
||||||
|
CLI 工具默认不展示结果详情，可以在[墨菲安全控制台](https://www.murphysec.com/control/project)-`项目`页面查看详细的检测结果 |
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## 命令介绍 |
||||||
|
|
||||||
|
### murphysec auth |
||||||
|
`murphysec auth` 命令主要是管理 CLI 的认证 |
||||||
|
|
||||||
|
``` |
||||||
|
Usage: |
||||||
|
murphysec auth [command] |
||||||
|
|
||||||
|
Available Commands: |
||||||
|
login |
||||||
|
logout |
||||||
|
``` |
||||||
|
|
||||||
|
### murphysec scan |
||||||
|
`murphysec scan` 命令主要用于执行检测 |
||||||
|
|
||||||
|
``` |
||||||
|
Usage: |
||||||
|
murphysec scan DIR [flags] |
||||||
|
|
||||||
|
Flags: |
||||||
|
-h, --help help for scan |
||||||
|
--json json output |
||||||
|
|
||||||
|
Global Flags: |
||||||
|
--log-level string specify log level, must be silent|error|warn|info|debug |
||||||
|
--no-log-file do not write log file |
||||||
|
--server string specify server address |
||||||
|
--token string specify API token |
||||||
|
-v, --version show version and exit |
||||||
|
--write-log-to string specify log file path |
||||||
|
|
||||||
|
``` |
||||||
|
|
||||||
|
## 常见问题 |
||||||
|
|
||||||
|
**1. Windows下安装失败，提示“PowerShell requires an execution policy of 'RemoteSigned'”** |
||||||
|
|
||||||
|
Powershell默认不允许从远程加载安装脚本，需要使用管理员权限打开Powershell窗口，并执行`Set-ExecutionPolicy RemoteSigned -scope CurrentUser`。随后执行安装命令即可成功。 |
||||||
|
|
||||||
|
**2. 为什么我的 Java（maven） 项目检测结果依赖信息不完整？** |
||||||
|
|
||||||
|
* 本地是否配置了 Maven 环境，可使用`mvn -v`查看 |
||||||
|
* 请检查 Maven 的源是否配置正确。如果是企业内部代码，通常需要配置公司的私有源地址。一般情况下可通过修改`~/.m2/settings.xml`进行配置 |
||||||
|
* 请检查代码目录下是否存在`pom.xml`文件，也可通过 `mvn dependency:tree --file="pom.xml"` 命令测试此项目本地是否可正常获取依赖 |
||||||
|
|
||||||
|
**3. 为什么检测完依赖和缺陷组件数量都是0 ？** |
||||||
|
|
||||||
|
* 检查您的项目/文件是否在目前支持的检测范围内 |
||||||
|
|
||||||
|
|
||||||
|
<!--auto_detail_active_begin_e1c6fb434b6f0baf6912c7a1934f772b--> |
||||||
|
## 项目相关 |
||||||
|
|
||||||
|
|
||||||
|
## 最近更新 |
||||||
|
|
||||||
|
<!--auto_detail_active_end_f9cf7911015e9913b7e691a7a5878527--> |
||||||
Loading…
Reference in new issue