Lab 10 - Ilvina Akhmetzianova

.github/pull_request_template.md

@@ -0,0 +1,22 @@
+## Goal
+<!-- Clearly describe the purpose and objective of this pull request. What problem does it solve or what feature does it add? -->
+
+## Changes
+<!-- List the key changes made in this PR. Bullet points are preferred. -->
+
+## Testing
+<!-- Describe how you tested these changes. Include any relevant test scenarios, steps to reproduce testing, or test results. -->
+
+## Artifacts & Screenshots
+<!-- Add any relevant screenshots, videos, or other visual artifacts that demonstrate the changes. -->
+
+## Checklist
+
+- [ ] PR has a clear, descriptive title
+- [ ] Documentation has been updated if applicable
+- [ ] No secrets or large temporary files are included in the changes
+
+---
+
+<!-- Example commit message for reference: -->
+<!-- docs: add PR template -->

.gitignore

@@ -0,0 +1,8 @@
+# Lab 4 — regeneratable scan outputs (do not commit)
+labs/lab4/grype-from-sbom.json
+labs/lab4/grype-from-sbom.txt
+labs/lab4/trivy.json
+labs/lab4/trivy.txt
+
+# Lab 10 — DefectDojo source clone (do not commit upstream code)
+labs/lab10/work/dd/

labs/lab10/imports/env.sample

@@ -0,0 +1,14 @@
+# Lab 10 — DefectDojo importer environment
+# Copy these into your shell (or `source labs/lab10/imports/env.sample`) before
+# running run-imports.sh.
+
+# DefectDojo base URL — the importer derives the API base ($DD_URL/api/v2).
+export DD_URL="http://localhost:8080"
+
+# API token: DefectDojo UI -> Profile -> API v2 Key.
+export DD_TOKEN="paste-your-token-here"
+
+# Optional overrides (defaults shown — match step 10.3):
+# export DD_PRODUCT_TYPE="Engineering"
+# export DD_PRODUCT="OWASP Juice Shop"
+# export DD_ENGAGEMENT="Course Semester Run"

labs/lab10/imports/run-imports.sh

@@ -0,0 +1,132 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Batch import helper for Lab 10.
+# Imports every Lab 4-7 scan report that exists into DefectDojo, auto-detecting
+# the scan_type names from your instance (with sane fallbacks if discovery fails).
+#
+# Usage:
+#   export DD_URL="http://localhost:8080"     # base URL (same as lab10.md step 10.2)
+#   export DD_TOKEN="<your_api_token>"         # Profile -> API v2 Key in the UI
+#   bash labs/lab10/imports/run-imports.sh
+#
+# Optional overrides (defaults shown):
+#   DD_API="$DD_URL/api/v2"
+#   DD_PRODUCT_TYPE="Engineering"
+#   DD_PRODUCT="OWASP Juice Shop"
+#   DD_ENGAGEMENT="Course Semester Run"
+#
+# File paths are resolved relative to the repo root, so the script runs from any
+# directory. Portable to bash 3.2 (stock macOS) — no mapfile/readarray.
+
+here_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+out_dir="$here_dir"
+repo_root="$(cd "$here_dir/../../.." && pwd)"   # labs/lab10/imports -> repo root
+
+require_env() {
+  local name="$1"
+  if [[ -z "${!name:-}" ]]; then
+    echo "ERROR: env var $name is required" >&2
+    exit 1
+  fi
+}
+
+require_env DD_TOKEN
+
+DD_URL="${DD_URL:-http://localhost:8080}"
+DD_API="${DD_API:-$DD_URL/api/v2}"
+DD_PRODUCT_TYPE="${DD_PRODUCT_TYPE:-Engineering}"
+DD_PRODUCT="${DD_PRODUCT:-OWASP Juice Shop}"
+DD_ENGAGEMENT="${DD_ENGAGEMENT:-Course Semester Run}"
+
+echo "Using context:"
+echo "  DD_API=$DD_API"
+echo "  DD_PRODUCT_TYPE=$DD_PRODUCT_TYPE"
+echo "  DD_PRODUCT=$DD_PRODUCT"
+echo "  DD_ENGAGEMENT=$DD_ENGAGEMENT"
+
+have_jq=true
+command -v jq >/dev/null 2>&1 || have_jq=false
+$have_jq || echo "WARN: jq not found; using default scan_type names." >&2
+
+# Discover scan_type names from the instance. Fallbacks keep the script working
+# even if discovery fails (no jq, instance not up, auth error).
+types=()
+if $have_jq; then
+  echo "Discovering importer names from /test_types/ ..."
+  while IFS= read -r name; do
+    [[ -n "$name" ]] && types+=("$name")
+  done < <(curl -sS -H "Authorization: Token $DD_TOKEN" \
+             "$DD_API/test_types/?limit=2000" 2>/dev/null | jq -r '.results[].name' 2>/dev/null)
+fi
+
+choose_type() {
+  local pat="$1" fallback="$2" t
+  if [[ ${#types[@]} -gt 0 ]]; then
+    for t in "${types[@]}"; do
+      if [[ "$t" =~ $pat ]]; then echo "$t"; return; fi
+    done
+  fi
+  echo "$fallback"
+}
+
+SCAN_GRYPE="$(choose_type '^Anchore Grype' 'Anchore Grype')"
+SCAN_TRIVY="$(choose_type '^Trivy Scan$' 'Trivy Scan')"
+SCAN_TRIVY_OP="$(choose_type '^Trivy Operator' 'Trivy Operator Scan')"
+SCAN_SEMGREP="$(choose_type '^Semgrep' 'Semgrep JSON Report')"
+SCAN_ZAP="$(choose_type '^ZAP' 'ZAP Scan')"
+SCAN_CHECKOV="$(choose_type '^Checkov' 'Checkov Scan')"
+SCAN_KICS="$(choose_type '^KICS' 'KICS Scan')"
+
+echo "Importer names:"
+echo "  Grype          = $SCAN_GRYPE"
+echo "  Trivy          = $SCAN_TRIVY"
+echo "  Trivy Operator = $SCAN_TRIVY_OP"
+echo "  Semgrep        = $SCAN_SEMGREP"
+echo "  ZAP            = $SCAN_ZAP"
+echo "  Checkov        = $SCAN_CHECKOV"
+echo "  KICS           = $SCAN_KICS"
+
+import_scan() {
+  local scan_type="$1" file="$2"
+  local rel="${file#"$repo_root"/}"
+  if [[ ! -f "$file" ]]; then
+    echo "SKIP: $scan_type — file not found: $rel"
+    return 0
+  fi
+  local tag base out
+  tag="$(basename "$(dirname "$file")")"; tag="${tag//[^A-Za-z0-9_.-]/_}"
+  base="$(basename "$file")";             base="${base//[^A-Za-z0-9_.-]/_}"
+  out="$out_dir/import-${tag}-${base}"
+  echo "Importing $scan_type from $rel"
+  if ! curl -sS -X POST "$DD_API/import-scan/" \
+      -H "Authorization: Token $DD_TOKEN" \
+      -F "scan_type=$scan_type" \
+      -F "file=@$file" \
+      -F "product_type_name=$DD_PRODUCT_TYPE" \
+      -F "product_name=$DD_PRODUCT" \
+      -F "engagement_name=$DD_ENGAGEMENT" \
+      -F "auto_create_context=true" \
+      -F "minimum_severity=Info" \
+      -F "close_old_findings=false" \
+      -F "push_to_jira=false" \
+      | tee "$out" >/dev/null; then
+    echo "  WARN: import request failed for $scan_type ($base)" >&2
+  fi
+}
+
+# Lab 4 — SCA (SBOM-derived)
+import_scan "$SCAN_GRYPE"    "$repo_root/labs/lab4/grype-from-sbom.json"
+import_scan "$SCAN_TRIVY"    "$repo_root/labs/lab4/trivy.json"
+# Lab 5 — DAST + SAST
+import_scan "$SCAN_SEMGREP"  "$repo_root/labs/lab5/results/semgrep.json"
+import_scan "$SCAN_ZAP"      "$repo_root/labs/lab5/results/auth-report.json"
+# Lab 6 — IaC
+import_scan "$SCAN_CHECKOV"  "$repo_root/labs/lab6/results/checkov-terraform/results_json.json"
+import_scan "$SCAN_KICS"     "$repo_root/labs/lab6/results/kics-ansible/results.json"
+import_scan "$SCAN_KICS"     "$repo_root/labs/lab6/results/kics-pulumi/results.json"
+# Lab 7 — Container image + K8s
+import_scan "$SCAN_TRIVY"    "$repo_root/labs/lab7/results/trivy-image.json"
+import_scan "$SCAN_TRIVY_OP" "$repo_root/labs/lab7/results/trivy-k8s.json"
+
+echo "Done. Import responses saved under $out_dir"

labs/lab10/work/import-all.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DD_URL="http://localhost:8080"
+DD_TOKEN="58b55869a7e20bb81ab9096e7b567c9d3896ddc5"
+REPO="/home/ucat/Learn/F25-DevSecOps-Intro"
+
+# Helper: import a scan
+import_scan() {
+  local scan_type="$1" file_path="$2" label="$3"
+  if [ ! -f "$file_path" ]; then
+    echo "[SKIP] $label: file not found at $file_path"
+    return
+  fi
+  echo "--- Importing: $label ($scan_type) ---"
+  curl -s -X POST "$DD_URL/api/v2/import-scan/" \
+    -H "Authorization: Token $DD_TOKEN" \
+    -F "scan_type=$scan_type" \
+    -F "engagement=1" \
+    -F "file=@$file_path" | jq '{id: .id, scan_type: .scan_type, verified: .verified, active: .active, findings: (.findings | length)}' 2>/dev/null || echo "Import failed for $label"
+}
+
+echo "=== Creating Engagement ==="
+ENG_ID=$(curl -s -X POST "$DD_URL/api/v2/engagements/" \
+  -H "Authorization: Token $DD_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"name":"Course Semester Run","product":1,"target_start":"2026-09-01","target_end":"2026-12-15","engagement_type":"CI/CD","status":"In Progress"}' | jq -r .id)
+echo "Engagement ID: $ENG_ID"
+
+echo ""
+echo "=== Importing all scan reports ==="
+
+# Lab 4
+import_scan "Anchore Grype" "$REPO/labs/lab4/grype-from-sbom.json" "Lab4-Grype"
+import_scan "Trivy Scan" "$REPO/labs/lab4/trivy.json" "Lab4-Trivy"
+
+# Lab 5
+import_scan "Semgrep JSON Report" "$REPO/labs/lab5/results/semgrep.json" "Lab5-Semgrep"
+import_scan "ZAP Scan" "$REPO/labs/lab5/results/auth-report.json" "Lab5-ZAP"
+
+# Lab 6
+import_scan "Checkov Scan" "$REPO/labs/lab6/results/checkov-terraform/results_json.json" "Lab6-Checkov"
+import_scan "KICS Scan" "$REPO/labs/lab6/results/kics-ansible/results.json" "Lab6-KICS-Ansible"
+import_scan "KICS Scan" "$REPO/labs/lab6/results/kics-pulumi/results.json" "Lab6-KICS-Pulumi"
+
+# Lab 7
+import_scan "Trivy Scan" "$REPO/labs/lab7/results/trivy-image.json" "Lab7-Trivy-Image"
+import_scan "Trivy Operator Scan" "$REPO/labs/lab7/results/trivy-k8s.json" "Lab7-Trivy-K8s"
+
+# Lab 8 — Cosign verify is not a vulnerability scan, just note it
+echo "[NOTE] Lab 8 cosign verify output exists but is not a vulnerability scan format"
+
+# Lab 9 — Falco log is custom, note it
+echo "[NOTE] Lab 9 Falco alerts are runtime events, not direct-scan imports"
+
+echo ""
+echo "=== Done. Checking finding counts... ==="
+curl -s -H "Authorization: Token $DD_TOKEN" "$DD_URL/api/v2/findings/?engagement=$ENG_ID&limit=1" | jq .count

labs/lab10/work/labs/lab5/results/semgrep.json

@@ -0,0 +1 @@
+{"version":"1.170.1","results":[],"errors":[],"paths":{"scanned":[]},"time":{"rules":[],"rules_parse_time":0.5445499420166016,"profiling_times":{"config_time":1.533139705657959,"core_time":0.9635887145996094,"ignores_time":0.0023849010467529297,"total_time":2.5078465938568115},"fixpoint_timeouts":[],"targets":[],"total_bytes":0,"max_memory_bytes":832637632},"engine_requested":"OSS","skipped_rules":[],"profiling_results":[]}

labs/lab10/work/labs/lab6/results/checkov-terraform/results_json.json

@@ -0,0 +1 @@
+2026-07-23 00:54:19,077 [MainThread  ] [ERROR]  Directory labs/lab6/vulnerable-iac/terraform/ does not exist; skipping it