Open

You will learn

How to log into ThreadFix, create a team, create applications, and begin uploading vulnerability scans for an Application or Infrastructure user.

Prerequisites

Audience: IT Professional, or End User
Difficulty: Basic
Time needed: Approximately 15 minutes
Tools required: Sample scan file w3af-demo-site.xml (optional)

Open

This section is a simple demo that walks through the basic ThreadFix setup and functionality after having set up ThreadFix per the ThreadFix Setup guides.

Accessing the Login Page

1. After launching Tomcat for the first time following ThreadFix deployment, ThreadFix will connect to the organization’s database server and populate the schema. This can take several minutes; the progress can be monitored via the <threadfix_deploy>/logs/threadfix.log file.
   
   

2. Locate a "Finished updating Enterprise Tags" entry to signal the deployment is complete. Access the login page to verify.

Example deployment URL

If the ThreadFix artifact was deployed in the <catalina_home>/webapps/threadfix directory, the ThreadFix URL, by default, would be the user’s Tomcat URL plus "/threadfix" at the end. For instance, If the user is connected to Tomcat at http://my.tomcat.server:8080, the user’s ThreadFix URL would be http://my.tomcat.server:8080/threadfix.

Logging In

Open

Log in with the following default credentials:

• Username: user

• Password: password

Application Usage

Dashboard

After logging in, users are presented with the Dashboard. To be able to upload a scan, the user needs to create at least one team and at least one application within that team.

Note an empty dashboard with no scans uploaded below:

Note a Dashboard populated with scan data below:

Create Team

1. Teams can be created from the Portfolio page which can be found by clicking on the Application menu from the Navigation sidebar and selecting the Portfolio page.
   
   

2. Click the Add Team button.
   
   

3. Type the desired team name in the New Team modal dialog and click the Add Team button.
   
   

    

4. A success banner will appear at the top of the Portfolio page, and the new team will be listed.
   
   

Create Application

1. To create an application in the new team, click the team name to expand it and click the Add Application button.
   
   

    

2. A New Application modal dialog will appear. Fill out at least the Name field to add an application.
   
   

    

3. A success banner will appear, and the team can be expanded to see the newly created application.
   
   

Upload Scan

1. Expand the application and click the Upload Scan button to open an Upload Scan dialog. Either drag and drop a scan file into the dialog or click Browse to navigate to the file. A sample scan file, w3af-demo-site.xml, has been provided.
   
   

2. Alternately, click on the application's link to navigate to its Application Details page and either drag and drop a scan file into it or click the Action button and select Upload Scan to open the same dialog shown below.
   
   

   
   Note the Upload Scan pop-up below:
   
   

Multiple Scan Upload

Users can upload more than one scan file at a time into ThreadFix by dragging them into the Application Details page or the Upload Scan dialog. ThreadFix will ask the user to choose between uploading them as a single scan (combining all of the scans' findings into a single scan) or as multiple scans. Note the example use cases for each option below:

• Single scan: If an application was scanned in parts (e.g., microservices) by the same scanning tool, the user can upload all of the scans encompassing the entire application as a single scan. Note that all subsequent uploads will need to include the newest available scan for all of the parts, whether they've all been re-scanned or not.

• Multiple scans: If a single application was scanned by more than one scanning tool, the user can upload all of the scans as multiple scans, which will result in ThreadFix aggregating and/or merging the findings from all of the scans.

Scan Queue

The uploaded scan will be put into a queue. Check its progress from the Application Details page by clicking on the application.

1. A banner at the top will indicate that changes are pending. Clicking the banner will expand it to show the scan upload being executed. When complete, the banner at the top will indicate as such.
   
   

2. Click the banner to refresh the page which will show the result of the uploaded scan.
   
   

Infrastructure Usage

Accessing the Login Page

After deploying ThreadFix for the first time, allow several minutes for it to complete. Run sudo docker ps -a to verify the containers started and are running as expected. Results should resemble the following:

Example deployment URL

If the login prompt does not render correctly in Internet Explorer, ensure that Compatibility View is disabled. E.g., it may be necessary to disable the "Display intranet sites in Compatibility View" setting.

Logging In

Log in with the following default credentials:

• Username: user

• Password: password

Dashboard

After logging in, the Infrastructure Dashboard will be displayed.

Networks

1. To get started, add one or more networks from the Network page found within the Infrastructure menu on the left. Click the Add New button on the top right.
   
   

    

2. Fill in the Network Name, Description, Location, and Department fields accordingly and specify the IP Ranges or list them individually. Click the Save button at the bottom to save the network.
   
   

Network Details

After saving one or more networks, they will be listed in the Network page, click on any of them to see statistics and details.

Assets

Assets will automatically get created, if missing, when uploading/importing a scan, but they can be created in advance.

1. To create an asset, from the Infrastructure menu, click on the Asset page and click the Add New button at the top right.
   
   

2. Fill in the details accordingly and click the Save button at the bottom when finished.
   
   

    

3. View its details, as well as edit/delete/archive the asset, from the Assets page.
   
   

Upload Scan

1. To upload a scan, click on the Scans page from the Infrastructure menu on the left and click the Upload Scan button.
   
   

    

2. Within the Upload Scan pop-up modal, either drag & drop or browse & select the scan file. A banner at the top will confirm the scan file was uploaded and is queued for processing.
   
   

Scan Queue

Within the Scans page, users can view the scan upload's status in the queue by clicking the <#> Scan Queued tab.

When complete, the scan will appear in the Imported Scans tab, along with asset and vulnerability counts.

Assets Added From Scan Upload

Users can view the assets what were added from the uploaded scans within the Scans page.

Dashboard After Scan Upload

Navigate back to the Dashboard page after the scan is processed to see updated vulnerability statistics.

Network Page After Scan Upload

Users can likewise see updated statistics for networks after processing a scan.

Vulnerability Details

Users can view vulnerability details for specific assets by drilling through the Network or Assets page. Below is an example vulnerability listing for an asset from the Assets page:

Note the results details below the graph.

Click on any of the vulnerabilities to see its details, change its severity/status, and/or create a defect.

Table of Contents