From 6c52da1075de91a92c91998b1d0ef5280307fa8d Mon Sep 17 00:00:00 2001 From: Jessy Ayala Date: Fri, 11 Sep 2020 20:23:55 -0700 Subject: [PATCH 1/4] first full attempt --- Vagrantfile | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/Vagrantfile b/Vagrantfile index 4781d48a7..6eafa6f65 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -38,6 +38,14 @@ Vagrant.configure("2") do |config| docker pull codeclimate/codeclimate wget https://raw.githubusercontent.com/codeclimate/codeclimate/master/codeclimate-wrapper -O /usr/local/bin/codeclimate chmod +x /usr/local/bin/codeclimate + #mobsf documentation + echo 'MobSF USAGE\n-----------' >> mobsf-README + echo 'To start a MobSF server in the background, run the command: docker run -itd -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest\n' >> mobsf-README + echo 'Afterwards, grab the API key by running: wget http://localhost:8000/api_docs; MOBSF_API_KEY=$\(grep \'REST API Key\' api_docs\); MOBSF_API_KEY=$\{MOBSF_API_KEY:42:64\}; rm api_docs\n' >> mobsf-README + echo 'Zip the source code for app/ directory inside remote and compute the hash: zip -d source_code app/; HASH=$\(md5sum source_code.zip\); HASH=\$\{HASH:0:32\}\n' >> mobsf-README + echo 'Upload the file to MobSF: curl -F \"file=\@source_code.zip\" http://localhost:8000/api/v1/upload -H \"Authorization:$MOBSF_API_KEY\"\n' >> mobsf-README + echo 'Perform the security scan: curl -X POST --url http://localhost:8000/api/v1/scan --data \"scan_type=zip\&file_name=source_code.zip\&hash=$HASH\" -H \"Authorization:\$MOBSF_API_KEY\"\n' >> mobsf-README + echo 'Download the results as PDF: curl -X POST --url http://localhost:8000/api/v1/download_pdf --data \"hash=$HASH\" -H \"Authorization:$MOBSF_API_KEY\" --output mobsf-security-scan.pdf' >> mobsf-README SHELL # Run binding on each startup make sure the mount is available on VM restart @@ -45,10 +53,22 @@ Vagrant.configure("2") do |config| docker pull codeclimate/codeclimate echo echo + docker pull opensecurity/mobile-security-framework-mobsf + echo + echo + echo + echo "CODECLIMATE USAGE" echo "vagrant ssh" echo "cd remote" echo "git checkout " echo "codeclimate help" + echo + echo + echo "MOBSF USAGE" + echo "vagrant ssh" + echo "cat mobsf-README" + echo + echo SHELL end end From 2b4899e5ed4654d9b30edf8d1cca791b7c2b08c1 Mon Sep 17 00:00:00 2001 From: Jessy Ayala Date: Fri, 11 Sep 2020 20:45:55 -0700 Subject: [PATCH 2/4] clarification of dir location --- Vagrantfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Vagrantfile b/Vagrantfile index 6eafa6f65..582db8446 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -42,7 +42,7 @@ Vagrant.configure("2") do |config| echo 'MobSF USAGE\n-----------' >> mobsf-README echo 'To start a MobSF server in the background, run the command: docker run -itd -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest\n' >> mobsf-README echo 'Afterwards, grab the API key by running: wget http://localhost:8000/api_docs; MOBSF_API_KEY=$\(grep \'REST API Key\' api_docs\); MOBSF_API_KEY=$\{MOBSF_API_KEY:42:64\}; rm api_docs\n' >> mobsf-README - echo 'Zip the source code for app/ directory inside remote and compute the hash: zip -d source_code app/; HASH=$\(md5sum source_code.zip\); HASH=\$\{HASH:0:32\}\n' >> mobsf-README + echo 'Zip the source code for app/ directory inside remote/ and compute the hash: zip -d source_code app/; HASH=$\(md5sum source_code.zip\); HASH=\$\{HASH:0:32\}\n' >> mobsf-README echo 'Upload the file to MobSF: curl -F \"file=\@source_code.zip\" http://localhost:8000/api/v1/upload -H \"Authorization:$MOBSF_API_KEY\"\n' >> mobsf-README echo 'Perform the security scan: curl -X POST --url http://localhost:8000/api/v1/scan --data \"scan_type=zip\&file_name=source_code.zip\&hash=$HASH\" -H \"Authorization:\$MOBSF_API_KEY\"\n' >> mobsf-README echo 'Download the results as PDF: curl -X POST --url http://localhost:8000/api/v1/download_pdf --data \"hash=$HASH\" -H \"Authorization:$MOBSF_API_KEY\" --output mobsf-security-scan.pdf' >> mobsf-README From eeee10fbcd3586430813790c9f58ee2afc55c3d0 Mon Sep 17 00:00:00 2001 From: Jessy Ayala Date: Fri, 18 Sep 2020 12:29:54 -0700 Subject: [PATCH 3/4] back at it again :) --- Vagrantfile | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/Vagrantfile b/Vagrantfile index 582db8446..64ded029f 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -40,12 +40,14 @@ Vagrant.configure("2") do |config| chmod +x /usr/local/bin/codeclimate #mobsf documentation echo 'MobSF USAGE\n-----------' >> mobsf-README - echo 'To start a MobSF server in the background, run the command: docker run -itd -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest\n' >> mobsf-README - echo 'Afterwards, grab the API key by running: wget http://localhost:8000/api_docs; MOBSF_API_KEY=$\(grep \'REST API Key\' api_docs\); MOBSF_API_KEY=$\{MOBSF_API_KEY:42:64\}; rm api_docs\n' >> mobsf-README - echo 'Zip the source code for app/ directory inside remote/ and compute the hash: zip -d source_code app/; HASH=$\(md5sum source_code.zip\); HASH=\$\{HASH:0:32\}\n' >> mobsf-README - echo 'Upload the file to MobSF: curl -F \"file=\@source_code.zip\" http://localhost:8000/api/v1/upload -H \"Authorization:$MOBSF_API_KEY\"\n' >> mobsf-README - echo 'Perform the security scan: curl -X POST --url http://localhost:8000/api/v1/scan --data \"scan_type=zip\&file_name=source_code.zip\&hash=$HASH\" -H \"Authorization:\$MOBSF_API_KEY\"\n' >> mobsf-README - echo 'Download the results as PDF: curl -X POST --url http://localhost:8000/api/v1/download_pdf --data \"hash=$HASH\" -H \"Authorization:$MOBSF_API_KEY\" --output mobsf-security-scan.pdf' >> mobsf-README + echo 'During Vagrant setup, a MobSF server was initiated with the command: docker run -itd -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest\n' >> mobsf-README + echo 'With MobSF, you are able to run a static analysis on the remote source code with the following steps\n\n' >> mobsf-README + echo '0. Store your API key by running: wget http://localhost:8000/api_docs; MOBSF_API_KEY=$\(grep "REST API Key" api_docs\); MOBSF_API_KEY=$\{MOBSF_API_KEY:42:64\}; rm api_docs\n' >> mobsf-README + echo '1. Zip the source code for app/ directory inside remote/ and compute the hash: zip -d source_code app/; HASH=$\(md5sum source_code.zip\); HASH=\$\{HASH:0:32\}\n' >> mobsf-README + echo '2. Upload the file to MobSF: curl -F \"file=\@source_code.zip\" http://localhost:8000/api/v1/upload -H \"Authorization:$MOBSF_API_KEY\"\n' >> mobsf-README + echo '3. Perform the security scan: curl -X POST --url http://localhost:8000/api/v1/scan --data \"scan_type=zip\&file_name=source_code.zip\&hash=$HASH\" -H \"Authorization:\$MOBSF_API_KEY\"\n' >> mobsf-README + echo '4. Download the results as PDF: curl -X POST --url http://localhost:8000/api/v1/download_pdf --data \"hash=$HASH\" -H \"Authorization:$MOBSF_API_KEY\" --output mobsf-security-scan.pdf' >> mobsf-README + echo '\nEnjoy! :)' >> mobsf-README SHELL # Run binding on each startup make sure the mount is available on VM restart @@ -54,6 +56,7 @@ Vagrant.configure("2") do |config| echo echo docker pull opensecurity/mobile-security-framework-mobsf + docker run -itd -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest echo echo echo @@ -69,6 +72,7 @@ Vagrant.configure("2") do |config| echo "cat mobsf-README" echo echo + echo SHELL end end From d8d1ee6f1537d385e6c16c39a66274dfd420f7c5 Mon Sep 17 00:00:00 2001 From: Jessy Ayala Date: Fri, 18 Sep 2020 12:43:21 -0700 Subject: [PATCH 4/4] updated docs --- Vagrantfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Vagrantfile b/Vagrantfile index 64ded029f..7c2df34c2 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -42,7 +42,7 @@ Vagrant.configure("2") do |config| echo 'MobSF USAGE\n-----------' >> mobsf-README echo 'During Vagrant setup, a MobSF server was initiated with the command: docker run -itd -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest\n' >> mobsf-README echo 'With MobSF, you are able to run a static analysis on the remote source code with the following steps\n\n' >> mobsf-README - echo '0. Store your API key by running: wget http://localhost:8000/api_docs; MOBSF_API_KEY=$\(grep "REST API Key" api_docs\); MOBSF_API_KEY=$\{MOBSF_API_KEY:42:64\}; rm api_docs\n' >> mobsf-README + echo '0. Retrieve and store your API key by running: wget http://localhost:8000/api_docs; MOBSF_API_KEY=$\(grep "REST API Key" api_docs\); MOBSF_API_KEY=$\{MOBSF_API_KEY:42:64\}; rm api_docs\n' >> mobsf-README echo '1. Zip the source code for app/ directory inside remote/ and compute the hash: zip -d source_code app/; HASH=$\(md5sum source_code.zip\); HASH=\$\{HASH:0:32\}\n' >> mobsf-README echo '2. Upload the file to MobSF: curl -F \"file=\@source_code.zip\" http://localhost:8000/api/v1/upload -H \"Authorization:$MOBSF_API_KEY\"\n' >> mobsf-README echo '3. Perform the security scan: curl -X POST --url http://localhost:8000/api/v1/scan --data \"scan_type=zip\&file_name=source_code.zip\&hash=$HASH\" -H \"Authorization:\$MOBSF_API_KEY\"\n' >> mobsf-README