Installing the DAST CLI in a Pipeline
You can integrate DAST with your favorite CI/CD pipelines. This section explains how the DAST CLI can be installed in a pipeline.
To run a DAST Scan, you need to have an outbound connection to Checkmarx One so we can upload the results. To do so, we must ensure that we can connect to the following IP (for BETA version-> Canary). For more information, please review the Checkmarx One External IPs page.
3.126.230.210
3.74.225.192
3.120.214.171
The following CI/CD pipelines integrate with DAST:
Note
Click here for a full list of DAST docker tags: Docker Tags.
To run Checkmarx DAST as a Docker image:
Download the Docker image. In your terminal, enter the command docker pull checkmarx/dast:X.X.X Replace the X.X.X with the version you want to download; for example, docker pull checkmarx/dast:1.0.1
Open the terminal and access the folder where the configuration and Swagger files (for an API scan) are located.
Run the following command to start the DAST scan from the docker image:
API Scan Example
docker run -e CX_APIKEY=$API_MASTER_KEY I am running a few minutes late; my previous meeting is running over.\ -v $(pwd):/demo checkmarx/dast:1.0.1 \ api \ --environment-id=889259e2-c24b-4dc7-99f5-67009c43e73c \ --config=/demo/zap_config_api.yaml \ --base-url=https://urlCxOne.com/ \ --output=/demo/test_output \ --timeout=10000 \ --update-interval=10 \ --jvm-properties=-Xmx3G \ --log-level=info \ --verbose \ --retry=3 \ --retry-delay=20 \ --fail-on HIGH \ --openapi /demo/openapi.yaml
Web Scan Example
docker run -e CX_APIKEY=$API_MASTER_KEY \ -v $(pwd):/demo checkmarx/dast:1.0.1 \ web \ --environment-id=889259e2-c24b-4dc7-99f5-67009c43e73c \ --config=/demo/zap_config_api.yaml \ --base-url=https://urlCxOne.com/ \ --output=/demo/test_output \ --timeout=10000 \ --update-interval=10 \ --jvm-properties=-Xmx3G \ --log-level=info \ --verbose \ --retry=3 \ --retry-delay=20 \ --fail-on HIGH \
Replace the following variables:
environment-id→ replace the ID with the corresponding ID on Checkmarx One. You can copy it from the UI.
config→ replace by the corresponding location of the configuration file.base-url→ Specify the URL of your Checkmarx One tenant.output→ specify the location for the output folder.openapi(only mandatory for API scans)→ specify the location of the Swagger file.
You can integrate DAST into your GitHub Actions CI/CD pipelines with a specific DAST GitHub Action and run DAST scans in your GItHub repositories.
Default Report Usage Example
# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v2
# Scan with DAST
- name: run dast web
uses: checkmarx/dast-action@latest
with:
config: 'zapconfig.yaml'
verbose: true
Workflow Failures: By default, DAST will fail your workflow on any results found. If you want your pipeline just to fail on HIGH severity results and DAST engine execution errors:
# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v2
# Scan with DAST
- name: run dast web
uses: checkmarx/dast-action@latest
with:
config: 'zapconfig.yaml'
verbose: true
environment_id: <ENVIRONMENT_ID>
fail_on: 'HIGH'
You can integrate DAST into your GitHub Actions CI/CD pipelines with a specific DAST GitHub Action and run DAST scans in your GitHub repositories. DAST CLI Authentication is made through Checkmarx One API Key. To generate an API Key follow these steps:
Go to Identity and Access Management
Go to API Keys
Create a new API Key
Copy the generated key
Create a GitHub action runner secret from the generated key
Set the environment variable CX_APIKEY to the newly created secret
steps: - name: Run DAST Scan uses: checkmarx/[email protected] env: CX_APIKEY: ${{ secrets.CX_ONE_API_KEY }}