📙 You will learn
How to add manual vulnerabilities to applications for tracking through the Pen Test feature.
Prerequisites
Audience: IT Professional and/or End User
Difficulty: Intermediate
Time needed: Approximately 30 minutes
Tools required: ThreadFix
Importing vulnerabilities from scanner files is quick and convenient, but ThreadFix also allows users to easily add manual vulnerabilities to applications for tracking through the Pen Test feature. The Pen Test feature allows users with the necessary permissions to build a list of manual findings over time and submit them as an assessment once the test is complete. This guide details the process for creating static, dynamic, and dependency findings with a Pen Test and interacting with these vulnerabilities afterward.
For information on how to create and manage Pen Test Teams, refer to the Manage Pen Test Teams guide. Permissions are required for creating, editing and deleting Pen Test Teams and findings. For information on permissions please see the documentation on Manage Roles.
Performing a Pen Test
To access the Pen Test page, open the application details page for a desired application and from the Action menu button select Perform Pen Test.
Pen Test Teams are comprised of users that have been placed on that team. More info on managing Pen Test team found on the Manage Pen Test Teams page.
Only users on a Pen Test Team can access the Pen Test page. Users will only have the option to select Pen Test Teams that they are members of. If a Pen Test Team has an active test, all users who access that Pen Test Team page will be brought to that active Pen Test. Members of the same Pen Test Team will all be able to add findings to the same Pen Test to be submitted as vulnerabilities from one Pen Test assessment.
When the Start Pen Test button is selected, all users with the appropriate permissions will be able to add findings to this Pen Test. This test will remain active until the test is submitted, at which point the findings are added to the application's vulnerabilities and editing of findings is limited.
Depending on permissions, the user now has the option to add a Finding, submit the Pen Test, and delete the Pen Test.
Add Findings
When the Add Finding is selected, the user is taken to the Add Finding page.
Here users are given the option to create a static, dynamic, or dependency finding within the appropriate tabs. Severity, Parameter, and a CWE or Summary are required for Static and Dynamic findings. Severity and CWE or Summary are required for Dependency findings. These fields are important as this is how ThreadFix merges findings. Dependency findings can merge without a matching CWE. For static and dynamic findings the CWE and parameter have to match in order for the findings to merge. For more information on finding merge requirements please see the examples of these findings below.
Uploading Evidence to Pentest Findings
Files can be added to findings as evidence (Note: files are saved as-is and not used as scans). Files can only be deleted before a Pen Test is submitted; afterward, the files are permanently attached to the finding.
Note the list of currently accepted file types for uploading to findings:
.csv
.fpr
.json
.nessus
.ozasmt
.xml
csv
doc
docx
JPEG
JPG
PDF
PNG
xls
xlsx
Note the following accepted file types that can be uploaded as scans:
From the Add Finding menu, users can scroll down to the Files section and with the Add File button, upload files.
Note the upload widget below:
Uploaded files will then be added to the files list.
Examples
Dynamic Finding
Required Fields
Severity
Parameter
CWE or Summary
URL
Dynamic findings will only merge with other findings whose parameter, CWE and URL match. Note that a dynamic finding can have both static and dynamic information.
Static Finding
Required Fields
Severity
Parameter
CWE or Summary
Source and Sink information
Static findings will only merge with other findings whose parameter, CWE, and source and sink information (file path and line number) match. Note that a static finding can have both static and dynamic information.
Dependency Finding
Required Fields
Severity
CWE or Summary (though summary is more common for dependency findings)
Library
Issue type
Reference
Dependency findings will only merge with other findings whose library, version number, and reference match (for dependency findings the CWE/summary and parameter are not required to match to merge with another finding).
Active Pen Test
After a finding is submitted to the Pen Test Team, it is listed under New Pen Test Findings’ where members of the team can edit and delete the finding.
Deleting an Assessment After Creating a Pen Test
Once a Pen Test has been started and is active, users cannot delete assessments from that Pen Test scanner type or upload a ThreadFix file for that scanner type in that application until the active Pen Test has been submitted or deleted.
Once the Pen Test has been submitted, the option to delete assessments from the Assessments tab will be provided.
Submitting a Pen Test
After clicking Submit Pen Test, a modal will display to set the date and time of the assessment.
Note: Once a Pen Test is submitted, it can no longer be edited or deleted from the Pen Test Findings page, they will be treated as scan findings.
After Pen Test Submission
After the Pen Test is submitted the vulnerabilities will display with the rest of the application's vulnerabilities. If another Pen Test is created from the same Pen Test Team, the user will be prompted to review open Pen Tests created by that team.
Not Remediated
If the Not Remediated button is selected, the finding is moved to the Not Remediated Pen Test Findings section.
Remediated
If the Remediated button is selected, it can be changed to Not Remediated or reverted. Again if revert is selected the finding is sent back to its original state of needing review.
Note: Remediating the findings will remove the vulnerabilities that Pen Test added from the application.
Table of Contents
| Table of Contents | ||
|---|---|---|
|