Kali Linux

DongTai : An Interactive Application Security testing(IAST) Product That Supports The Detection Of OWASP WEB TOP 10 Vulnerabilities, Multi-Request Related Vulnerabilities (Including Logic Vulnerabilities, Unauthorized Access Vulnerabilities, Etc.), Third-Party Component Vulnerabilities, Etc.

DongTai IAST is an open-source passive interactive security testing (IAST) product. It uses dynamic hooks and taint tracking algorithms to achieve universal vulnerability detection and multiples request associated with vulnerability detection (including but not limited to unauthorized vulnerabilities, overpower vulnerabilities)Third-party component vulnerability detection, etc. Currently, applications in Java and Python are supported for vulnerability detection.

Architecture

DongTai IAST has multiple basic services, including DongTai-webDongTai-webapiDongTai-openapiDongTai-engineagentDongTai-deployDongTai-Base-Image and DongTai-Plugin-IDEA:

  • DongTai-web is the product page of DongTai, which is used to handle the interaction between users and cave states.
  • DongTai-webapi is responsible for handling user-related operations.
  • DongTai-openapi is used to process the registration/heartbeat/call method/third-party component/error log data reported by agent, issue hook strategy, issue probe control commands, etc.
  • DongTai-engine analyzes whether there are vulnerabilities in HTTP/HTTPS/RPC requests according to the calling method data and taint tracking algorithm, and is also responsible for other related timing tasks.
  • agent is a probe module of DongTai, including data collection terminals in different programming languages, used to collect data during application runtime and report to the DongTai-OpenAPI service.
  • DongTai-deploy is used for the deployment of DongTai IAST, including docker-compose single-node deployment, Kubernetes cluster deployment, etc. If you want a deployment plan, you can add features or contribute to the deployment plan.
  • DongTai-Base-Image contains the basic services that DongTai depends on runtime, including MySql, Redis.
  • DongTai-Plugin-IDEA is the IDEA plug-in corresponding to the Java probe. You can run the Java probe directly through the plug-in and detect the vulnerabilities directly in IDEA.

Scenario

The usage scenarios of “DongTai IAST” include but not limited to:

  • Embed the DevSecOps process to realize automatic detection of application vulnerabilities/third-party component combing/third-party component vulnerability detection.
  • Common vulnerability mining for open source software/open source components.
  • Security testing before release, etc.

Quick start

DongTai IAST supports SaaS Service and Localized Deployment. Please refer to Deployment Document for localized deployment.

SaaS Version

  • Fill out the Online Form to register an account.
  • Log in to the [DongTai IAST] (https://iast.huoxian.cn).
  • Have a quick start with Online Guideline.

Localized Deployment Version [Open Source for Jointly Partnership]

Please follow the instructions bellow to apply the localized deployment version

DongTai IAST supports a variety of deployment schemes which refer to Deployment Document:

  • Stand-alone Deployment
    • Docker-compose
    • docker – pending upgrade
  • Cluster Deployment
    • Kubernetes

Docker-compose

$ git clone git@github.com:HXSecurity/DongTai.git
$ cd DongTai
$ chmod u+x build_with_docker_compose.sh
$ ./build_with_docker_compose.sh

How To Apply

DongTai IAST Jointly Partnership Program, registration address

R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 week ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 week ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago