fix: enhance security with automated tests for critical endpoints using Bright

.brightsec/tests/get-about.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /about', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['excessive_data_exposure', 'csrf', 'xss', 'open_database', 'secret_tokens'],
+      attackParamLocations: [AttackParamLocation.PATH, AttackParamLocation.HEADER]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/about`
+    });
+});

.brightsec/tests/get-audit.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /audit', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['excessive_data_exposure', 'csrf', 'sqli', 'xss'],
+      attackParamLocations: [AttackParamLocation.QUERY]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/audit`
+    });
+});

.brightsec/tests/get-create-paste.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /create_paste', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'excessive_data_exposure', 'xss', 'improper_asset_management'],
+      attackParamLocations: [AttackParamLocation.QUERY, AttackParamLocation.PATH]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/create_paste`
+    });
+});

.brightsec/tests/get-difficulty-easy.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /difficulty/easy', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'excessive_data_exposure', 'unvalidated_redirect', 'improper_asset_management'],
+      attackParamLocations: [AttackParamLocation.PATH, AttackParamLocation.QUERY]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/difficulty/easy`
+    });
+});

.brightsec/tests/get-difficulty-hard.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /difficulty/hard', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'excessive_data_exposure', 'unvalidated_redirect'],
+      attackParamLocations: [AttackParamLocation.PATH]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/difficulty/hard`
+    });
+});

.brightsec/tests/get-import-paste.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /import_paste', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['ssrf', 'osi', 'unvalidated_redirect', 'excessive_data_exposure'],
+      attackParamLocations: [AttackParamLocation.PATH, AttackParamLocation.QUERY]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/import_paste`
+    });
+});

.brightsec/tests/get-my-pastes.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /my_pastes', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'excessive_data_exposure', 'xss', 'sqli', 'ssrf'],
+      attackParamLocations: [AttackParamLocation.QUERY, AttackParamLocation.PATH]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/my_pastes`
+    });
+});

.brightsec/tests/get-public-pastes.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /public_pastes', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['excessive_data_exposure', 'csrf', 'xss', 'ssrf'],
+      attackParamLocations: [AttackParamLocation.QUERY, AttackParamLocation.HEADER]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/public_pastes`
+    });
+});

.brightsec/tests/get-root.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'excessive_data_exposure', 'sqli', 'ssrf', 'osi', 'xss'],
+      attackParamLocations: [AttackParamLocation.QUERY, AttackParamLocation.HEADER]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/`
+    });
+});

.brightsec/tests/get-solutions.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /solutions', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['excessive_data_exposure', 'csrf', 'xss', 'improper_asset_management'],
+      attackParamLocations: [AttackParamLocation.PATH, AttackParamLocation.QUERY, AttackParamLocation.HEADER]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/solutions`
+    });
+});

.brightsec/tests/get-start-over.test.ts

@@ -0,0 +1,33 @@
+import { test, before, after } from 'node:test';
+import { Severity, AttackParamLocation, HttpMethod } from '@sectester/scan';
+import { SecRunner } from '@sectester/runner';
+
+let runner!: SecRunner;
+
+before(async () => {
+  runner = new SecRunner({
+    hostname: process.env.BRIGHT_HOSTNAME!,
+    projectId: process.env.BRIGHT_PROJECT_ID!
+  });
+
+  await runner.init();
+});
+
+after(() => runner.clear());
+
+const timeout = 40 * 60 * 1000;
+const baseUrl = process.env.BRIGHT_TARGET_URL!;
+
+test('GET /start_over', { signal: AbortSignal.timeout(timeout) }, async () => {
+  await runner
+    .createScan({
+      tests: ['csrf', 'excessive_data_exposure', 'unvalidated_redirect', 'open_database', 'sqli'],
+      attackParamLocations: [AttackParamLocation.PATH, AttackParamLocation.QUERY, AttackParamLocation.HEADER]
+    })
+    .threshold(Severity.CRITICAL)
+    .timeout(timeout)
+    .run({
+      method: HttpMethod.GET,
+      url: `${baseUrl}/start_over`
+    });
+});