GitHub action for AppSweep Mobile Application Security Testing

Last update: Oct 06, 2022

Overview

GitHub action for AppSweep Mobile Application Security Testing

Usage

This action can be used to automate scanning your Android application using a GitHub action

Example workflow

# This workflow will initiate a Guardsquare AppSweep scan of your APK
name: AppSweep mobile application security testing
on: [push]
jobs:
  appsweep-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/[email protected]
        with:
          repository: ''

      - uses: guardsquare/[email protected]
        env:
          APPSWEEP_API_KEY: ${{ secrets.APPSWEEP_API_KEY }}
          INPUT_FILE: InsecureBankv2.apk

Inputs

Input	Description
`APPSWEEP_API_KEY`	Project API key for your AppSweep project, should be stored using Github SECRETS
`INPUT_FILE`	The APK that will be uploaded to AppSweep
`MAPPING_FILE` (optional)	An optional obfuscation mapping file for the build
`LIBRARY_FILE` (optional)	An optional library mapping file for the build
`COMMIT_HASH` (optional)	An optional commit hash of the build
`TAGS` (optional)	An optional set of tags to append to your build

Examples

Using the optional input

This is how to use the optional input.

# This workflow will initiate a Guardsquare AppSweep scan of your APK
name: AppSweep mobile application security testing
on: [push]
jobs:
  appsweep-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/[email protected]
        with:
          repository: ''

      - uses: guardsquare/[email protected]
        env:
          APPSWEEP_API_KEY: ${{ secrets.APPSWEEP_API_KEY }}
          INPUT_FILE: InsecureBankv2.apk
          MAPPING_FILE: mapping.txt
          LIBRARY_FILE:
          COMMIT_HASH: ${{ steps.vars.outputs.sha_short }}
          TAGS: release

Sixpack is a language-agnostic a/b-testing framework

Sixpack Sixpack is a framework to enable A/B testing across multiple programming languages. It does this by exposing a simple API for client libraries

1.7k Dec 24, 2022

Automatically mock your HTTP interactions to simplify and speed up testing

VCR.py 📼 This is a Python version of Ruby's VCR library. Source code https://github.com/kevin1024/vcrpy Documentation https://vcrpy.readthedocs.io/ R

2.3k Jan 1, 2023

fsociety Hacking Tools Pack – A Penetration Testing Framework

Fsociety Hacking Tools Pack A Penetration Testing Framework, you will have every script that a hacker needs. Works with Python 2. For a Python 3 versi

8.2k Jan 3, 2023

Scalable user load testing tool written in Python

Locust Locust is an easy to use, scriptable and scalable performance testing tool. You define the behaviour of your users in regular Python code, inst

15.3k Feb 8, 2021

Automatically mock your HTTP interactions to simplify and speed up testing

VCR.py 📼 This is a Python version of Ruby's VCR library. Source code https://github.com/kevin1024/vcrpy Documentation https://vcrpy.readthedocs.io/ R

1.8k Feb 7, 2021

Language-agnostic HTTP API Testing Tool

Dredd — HTTP API Testing Framework Dredd is a language-agnostic command-line tool for validating API description document against backend implementati

4k Jan 5, 2023

Web testing library for Robot Framework

SeleniumLibrary Contents Introduction Keyword Documentation Installation Browser drivers Usage Extending SeleniumLibrary Community Versions History In

1.2k Jan 3, 2023

✅ Python web automation and testing. 🚀 Fast, easy, reliable. 💠

Build fast, reliable, end-to-end tests. SeleniumBase is a Python framework for web automation, end-to-end testing, and more. Tests are run with "pytes

3k Jan 4, 2023

A command-line tool and Python library and Pytest plugin for automated testing of RESTful APIs, with a simple, concise and flexible YAML-based syntax

1.0 Release See here for details about breaking changes with the upcoming 1.0 release: https://github.com/taverntesting/tavern/issues/495 Easier API t

909 Dec 15, 2022

Comments

Missing docs on how to format a library mapping file properly (LIBRARY_FILE input)
Hello! 👋

I decided to open this issue after trying to figure the proper format for the libraries mapping file (accepted by this GHA) by myself.

I've followed the source code from Gradle plugin, but not sure what I'm missing. On my case, I'm transforming my project's dependencies - generated by the well established Ben Manes plugin for Gradle - into something that AppSweep would accepts

Example of Workflow run (library mapping attached on Workflow artefacts)

Related build that could not be analyzed by AppSweep
opened by ubiratansoares 2
Bump requests from 2.7.0 to 2.20.0
Bumps requests from 2.7.0 to 2.20.0.

Changelog

Sourced from requests's changelog.

2.20.0 (2018-10-18)

Bugfixes

Content-Type header parsing is now case-insensitive (e.g. charset=utf8 v Charset=utf8).

Fixed exception leak where certain redirect urls would raise uncaught urllib3 exceptions.

Requests removes Authorization header from requests redirected from https to http on the same hostname. (CVE-2018-18074)

should_bypass_proxies now handles URIs without hostnames (e.g. files).

Dependencies

Requests now supports urllib3 v1.24.

Deprecations

Requests has officially stopped support for Python 2.6.

2.19.1 (2018-06-14)

Bugfixes

Fixed issue where status_codes.py's init function failed trying to append to a __doc__ value of None.

2.19.0 (2018-06-12)

Improvements

Warn user about possible slowdown when using cryptography version < 1.3.4

Check for invalid host in proxy URL, before forwarding request to adapter.

Fragments are now properly maintained across redirects. (RFC7231 7.1.2)

Removed use of cgi module to expedite library load time.

Added support for SHA-256 and SHA-512 digest auth algorithms.

Minor performance improvement to Request.content.

Migrate to using collections.abc for 3.7 compatibility.

Bugfixes

Parsing empty Link headers with parse_header_links() no longer return one bogus entry.

... (truncated)

Commits

bd84045 v2.20.0

7fd9267 remove final remnants from 2.6

6ae8a21 Add myself to AUTHORS

89ab030 Use comprehensions whenever possible

2c6a842 Merge pull request #4827 from webmaven/patch-1

30be889 CVE URLs update: www sub-subdomain no longer valid

a6cd380 Merge pull request #4765 from requests/encapsulate_urllib3_exc

bbdbcc8 wrap url parsing exceptions from urllib3's PoolManager

ff0c325 Merge pull request #4805 from jdufresne/https

b0ad249 Prefer https:// for URLs throughout project

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Fixes GHA coordinates provided at examples

After trying this GHA in one of my projects, I caught this error, since the examples point to the another convention name instead of the one used by the default branch in this repository.

This PR fixes that. Successful Workflow run here

opened by ubiratansoares 0

Releases(v1.0)

v1.0(Oct 28, 2021)

Initial release of a GitHub action to integrate with AppSweep, a mobile application security testing tool by Guardsquare
Source code(tar.gz)
Source code(zip)

Owner

Guardsquare

GitHub Repository

Minimal example of getting Django + PyTest running on GitHub Actions

Minimal Django + Pytest + GitHub Actions example This minimal example shows you how you can runs pytest on your Django app on every commit using GitHu

5 Sep 19, 2022

BDD library for the py.test runner

BDD library for the py.test runner pytest-bdd implements a subset of the Gherkin language to enable automating project requirements testing and to fac

1.1k Jan 09, 2023

Automatic SQL injection and database takeover tool

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of

25.7k Jan 04, 2023

FaceBot is a script to automatically create a facebook account using the selenium and chromedriver modules.

FaceBot is a script to automatically create a facebook account using the selenium and chromedriver modules. That way, we don't need to input full name, email and password and date of birth. All will

2 Jun 17, 2022

Wraps any WSGI application and makes it easy to send test requests to that application, without starting up an HTTP server.

WebTest This wraps any WSGI application and makes it easy to send test requests to that application, without starting up an HTTP server. This provides

325 Dec 30, 2022

Green is a clean, colorful, fast python test runner.

Green -- A clean, colorful, fast python test runner. Features Clean - Low redundancy in output. Result statistics for each test is vertically aligned.

756 Dec 22, 2022

WrightEagle AutoTest (Has been updated by Cyrus team members)

Autotest2d WrightEagle AutoTest (Has been updated by Cyrus team members) Thanks go to WrightEagle Members. Steps 1- prepare start_team file. In this s

3 Sep 01, 2022

Mixer -- Is a fixtures replacement. Supported Django, Flask, SqlAlchemy and custom python objects.

The Mixer is a helper to generate instances of Django or SQLAlchemy models. It's useful for testing and fixture replacement. Fast and convenient test-

871 Dec 25, 2022

A folder automation made using Watch-dog, it only works in linux for now but I assume, it will be adaptable to mac and PC as well

folder-automation A folder automation made using Watch-dog, it only works in linux for now but I assume, it will be adaptable to mac and PC as well Th

31 May 28, 2021

Voip Open Linear Testing Suite

VOLTS Voip Open Linear Tester Suite Functional tests for VoIP systems based on voip_patrol and docker 10'000 ft. view System is designed to run simple

17 Dec 30, 2022

Automated mouse clicker script using PyAutoGUI and Typer.

clickpy Automated mouse clicker script using PyAutoGUI and Typer. This app will randomly click your mouse between 1 second and 3 minutes, to prevent y

0 Dec 01, 2021

Data-Driven Tests for Python Unittest

DDT (Data-Driven Tests) allows you to multiply one test case by running it with different test data, and make it appear as multiple test cases. Instal

424 Nov 28, 2022

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

mitmproxy mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets. mitmdump is the

29.7k Jan 02, 2023

Faker is a Python package that generates fake data for you.

Faker is a Python package that generates fake data for you. Whether you need to bootstrap your database, create good-looking XML documents, fill-in yo

15.2k Jan 01, 2023

API Test Automation with Requests and Pytest

api-testing-requests-pytest Install Make sure you have Python 3 installed on your machine. Then: 1.Install pipenv sudo apt-get install pipenv 2.Go to

2 Nov 21, 2021

It's a simple script to generate a mush on code forces, the script will accept the public problem urls only or polygon problems.

Codeforces-Sheet-Generator It's a simple script to generate a mushup on code forces, the script will accept the public problem urls only or polygon pr

10 Aug 02, 2022

GitHub action for AppSweep Mobile Application Security Testing

Related tags

Overview

GitHub action for AppSweep Mobile Application Security Testing

Usage

Example workflow

Inputs

Examples

Using the optional input

You might also like...

Sixpack is a language-agnostic a/b-testing framework

Automatically mock your HTTP interactions to simplify and speed up testing

fsociety Hacking Tools Pack – A Penetration Testing Framework

Scalable user load testing tool written in Python

Automatically mock your HTTP interactions to simplify and speed up testing

Language-agnostic HTTP API Testing Tool

Web testing library for Robot Framework

✅ Python web automation and testing. 🚀 Fast, easy, reliable. 💠

A command-line tool and Python library and Pytest plugin for automated testing of RESTful APIs, with a simple, concise and flexible YAML-based syntax

Comments

Missing docs on how to format a library mapping file properly (LIBRARY_FILE input)

Bump requests from 2.7.0 to 2.20.0

2.20.0 (2018-10-18)

2.19.1 (2018-06-14)

2.19.0 (2018-06-12)

Fixes GHA coordinates provided at examples

Releases(v1.0)

v1.0(Oct 28, 2021)

Owner

Guardsquare

Minimal example of getting Django + PyTest running on GitHub Actions

BDD library for the py.test runner

Automatic SQL injection and database takeover tool

FaceBot is a script to automatically create a facebook account using the selenium and chromedriver modules.

Wraps any WSGI application and makes it easy to send test requests to that application, without starting up an HTTP server.

Green is a clean, colorful, fast python test runner.

WrightEagle AutoTest (Has been updated by Cyrus team members)

Mixer -- Is a fixtures replacement. Supported Django, Flask, SqlAlchemy and custom python objects.

A folder automation made using Watch-dog, it only works in linux for now but I assume, it will be adaptable to mac and PC as well

Voip Open Linear Testing Suite

Automated mouse clicker script using PyAutoGUI and Typer.

Data-Driven Tests for Python Unittest

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

Faker is a Python package that generates fake data for you.

API Test Automation with Requests and Pytest

It's a simple script to generate a mush on code forces, the script will accept the public problem urls only or polygon problems.

Python wrapper of Android uiautomator test tool.

Spam the buzzer and upgrade automatically - Selenium

One-stop solution for HTTP(S) testing.

1st Solution to QQ Browser 2021 AIAC Track 2