القائمة
Tests de sécurité automatisés — SAST, DAST, SCA, dependency scanning, ZAP, Nuclei, Trivy, secret detection, et intégration CI/CD DevSecOps.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/JohnNuwan/EVA_CORE --skill security-testingيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
استنادا إلى تصنيف SOC المهني
| name | security-testing |
| description | Tests de sécurité automatisés — SAST, DAST, SCA, dependency scanning, ZAP, Nuclei, Trivy, secret detection, et intégration CI/CD DevSecOps. |
| version | 1.0.0 |
| author | EVA |
| license | MIT |
| metadata | {"hermes":{"tags":["security-testing","sast","dast","sca","devsecops","zap","nuclei","trivy","pentest"],"related_skills":["integration-testing","e2e-testing","performance-testing"]}} |
Les tests de sécurité automatisés s'intègrent dans le pipeline CI/CD pour détecter les vulnérabilités tôt dans le cycle de développement (Shift Left). Quatre grandes catégories : SAST (statique), DAST (dynamique), SCA (dépendances), Secret Detection.
Code (repo) Build Prod
SAST ──────────→ SCA ──────────→ Secret ──────→ DAST
Semgrep Trivy / Dependabot Gitleaks / ZAP / Nuclei
SonarQube Grype / Snyk TruffleHog
CodeQL
# Installation
pip install semgrep
# Lancer sur un projet
semgrep scan --config=auto --config=p/r2c-ci .
semgrep scan --config=auto --output=semgrep-report.sarif
# Règles personnalisées
semgrep scan --config=rules/my-rules.yaml
# Règles OWASP
semgrep scan --config=p/owasp-top-ten
# CI-friendly (code non-zero en cas de trouvaille)
semgrep scan --config=auto --error .
Exemple de règle personnalisée :
# rules/security/no-sql-injection.yaml
rules:
- id: python-sql-injection
patterns:
- pattern: |
cursor.execute(f"...{...}...")
- pattern-not: |
cursor.execute(..., (...,))
message: "❌ SQL Injection détectée : ne pas utiliser f-strings dans execute()"
languages: [python]
severity: ERROR
metadata:
cwe: "CWE-89"
owasp: "A1: Injection"
# .github/workflows/codeql.yml
name: CodeQL
on: [push, pull_request]
jobs:
analyze:
runs-on: ubuntu-latest
language: [python, javascript, java]
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
queries: security-and-quality
- uses: github/codeql-action/analyze@v3
# Local
sonar-scanner \
-Dsonar.projectKey=myproject \
-Dsonar.sources=. \
-Dsonar.host.url=http://localhost:9000 \
-Dsonar.login=$SONAR_TOKEN
# GitHub Actions — intégré
sonarcloud.github.action
# Installation
sudo apt install trivy
# ou
docker pull aquasec/trivy
# Scanner le système de fichiers
trivy fs . --severity CRITICAL,HIGH
# Scanner une image Docker
trivy image myapp:latest --severity CRITICAL,HIGH
# Scanner le SBOM
trivy fs --format cyclonedx --output sbom.json .
# En mode CI
trivy fs --exit-code 1 --severity CRITICAL,HIGH .
# .github/workflows/trivy.yml
name: Trivy SCA
on: [push]
jobs:
trivy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Trivy
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
scan-ref: '.'
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH'
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'
# Installation
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
# Analyse
grype . --fail-on high
# SBOM
syft . -o json > sbom.json
grype sbom:sbom.json
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: 'pip'
directory: '/'
schedule:
interval: 'weekly'
day: 'monday'
open-pull-requests-limit: 10
labels:
- 'dependencies'
- 'security'
- package-ecosystem: 'npm'
directory: '/'
schedule:
interval: 'weekly'
# Installation
brew install gitleaks
# ou
docker pull zricethezav/gitleaks
# Détection de secrets dans le repo
gitleaks detect --source . --verbose
# En mode CI
gitleaks detect --source . --report-path gitleaks-report.json --exit-code 1
# Scan les commits passés
gitleaks detect --source . --log-opts="--all"
# .github/workflows/gitleaks.yml
name: Secret Detection
on: [push, pull_request]
jobs:
gitleaks:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with: { fetch-depth: 0 }
- uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Installation
pip install trufflehog
# Scan du repo
trufflehog git https://github.com/user/repo --only-verified
# Scan de fichiers
trufflehog filesystem . --only-verified
# Scan Docker
trufflehog docker myimage:latest --only-verified
# Docker
docker pull ghcr.io/zaproxy/zaproxy:stable
# Scan passif (sans attaque)
docker run -v $(pwd):/zap/wrk/:rw -t \
ghcr.io/zaproxy/zaproxy:stable \
zap-full-scan.py -t https://target.com \
-r report.html
# Scan actif (avec attaques)
docker run -v $(pwd):/zap/wrk/:rw -t \
ghcr.io/zaproxy/zaproxy:stable \
zap-api-scan.py -t https://target.com/api/openapi.json \
-f openapi -r report.html
# Avec authentification
docker run -v $(pwd):/zap/wrk/:rw -t \
ghcr.io/zaproxy/zaproxy:stable \
zap-full-scan.py -t https://target.com \
-r report.html \
--hook=/zap/wrk/auth_hook.py
# auth_hook.py
def zap_started(zap, target):
"""Prépare le contexte d'authentification pour ZAP."""
# Configurer le context
context_id = zap.context.new_context('myapp')
zap.context.include_in_context(context_id, 'https://target.com/.*')
# Login via POST form
session_id = zap.replacer.add_rule(
description='Auth session',
match_type='REQ_HEADER',
match_string='Authorization',
replacement='Bearer mock-token',
)
# Ajouter l'utilisateur
user_id = zap.users.new_user(context_id, 'testuser')
zap.users.set_authentication_credentials(
context_id, user_id,
{'username': 'admin@test.com', 'password': 'test123'}
)
zap.users.set_user_enabled(context_id, user_id, True)
# Installation
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
# ou
brew install nuclei
# Scan d'une cible
nuclei -u https://target.com
# Templates spécifiques
nuclei -u https://target.com -t cves/ -t exposures/
# Scan OWASP Top 10
nuclei -u https://target.com -t ~/nuclei-templates/http/misconfiguration/
# Export
nuclei -u https://target.com -o nuclei-report.json -json
# .github/workflows/nuclei.yml
name: Nuclei DAST
on:
schedule:
- cron: '0 8 * * 1' # Chaque lundi
jobs:
nuclei:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Nuclei
uses: projectdiscovery/nuclei-action@main
with:
target: https://staging.example.com
templates: cves,misconfiguration
- name: Upload report
uses: actions/upload-artifact@v4
with:
name: nuclei-report
path: nuclei-report.json
name: DevSecOps Pipeline
on: [push, pull_request]
jobs:
security-checks:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with: { fetch-depth: 0 }
# 1. SAST
- name: Semgrep SAST
uses: semgrep/semgrep-action@v1
with:
config: auto
# 2. Secret Detection
- name: Gitleaks
uses: gitleaks/gitleaks-action@v2
# 3. SCA
- name: Trivy
uses: aquasecurity/trivy-action@master
with:
scan-type: fs
scan-ref: .
severity: CRITICAL,HIGH
# 4. Container Scan
- name: Trivy Image
uses: aquasecurity/trivy-action@master
with:
| Outil | Classe | Détecte |
|---|---|---|
| Semgrep/CodeQL | SAST | Injections, XSS, path traversal, hardcoded secrets, mauvaises pratiques crypto |
| Trivy/Grype | SCA | CVE dans les dépendances, packages obsolètes, licenses |
| Gitleaks/TruffleHog | Secrets | API keys, tokens, mots de passe, clés SSH committés |
| ZAP | DAST | XSS, SQLi, CSRF, mauvaises configs headers, cookie flaws |
| Nuclei | DAST | CVEs connues, misconfigurations cloud, expositions |
| Dependabot/Renovate | SCA | Alertes et PRs automatiques pour dépendances vulnérables |
| # | Vulnérabilité | SAST | DAST | SCA |
|---|---|---|---|---|
| A1 | Injection (SQL, NoSQL, OS) | ✅ Semgrep/CodeQL | ✅ ZAP | ❌ |
| A2 | Broken Authentication | ⚠️ Partiel | ✅ ZAP | ❌ |
| A3 | Sensitive Data Exposure | ⚠️ Partiel | ✅ ZAP/Nuclei | ❌ |
| A4 | XXE (XML External Entities) | ✅ Semgrep | ✅ ZAP | ❌ |
| A5 | Broken Access Control | ⚠️ Partiel | ✅ ZAP/Nuclei | ❌ |
| A6 | Security Misconfiguration | ❌ | ✅ Nuclei/ZAP | ❌ |
| A7 | XSS (Cross-Site Scripting) | ✅ Semgrep/CodeQL | ✅ ZAP | ❌ |
| A8 | Insecure Deserialization | ✅ Semgrep | ✅ ZAP | ⚠️ (lib vulnérables) |
| A9 | Known Vulnerabilities | ❌ | ❌ | ✅ Trivy/Grype |
| A10 | Logging & Monitoring | ❌ | ❌ | ❌ (ops) |