Awesome
Attack-on-Web(AoW)
AttackOn-Web is a CLI application that runs in your local system environment or in a CI environment to assist you with identifying 20 (More added soon) kinds of secret/API Keys, just as other potential security weaknesses or policy breaks.
AOW utilizes our local APIs to filter your code and identify expected secret/API Keys in your code. We won't store any records you are sending or any secret keys we have recognized.
Test using CLI
npm i atow
npx atow
npx is a package runner tool that comes with npm 5.2+ and higher.
Commands Usage: npx atow [OPTIONS]
Options:
-h or --help to view list of commands
-t or --test for testing.
-l or --list for list of providers.
OUTPUT
If no secrets or policy breaks have been found, the exit code will be 0:
If a secret or other issue is found in your staged code or in your CI, you will have an alert giving you the type of policy break, the filename where the policy break has been found and a patch giving you the position of the policy break in the file:
✔ Read fileD:\MLH\dev-tools\attack-on-web\node_modules\yargs-parser\build\lib\yargs-parser.js
✔ Read fileD:\MLH\dev-tools\attack-on-web\src\check.js
✔ Read fileD:\MLH\dev-tools\attack-on-web\src\checkGitignoreRegex.js
✔ Read fileD:\MLH\dev-tools\attack-on-web\src\crawl.js
✖ Stripe API Key found in D:\MLH\dev-tools\attack-on-web\src\extensionChecker.js
2 const check = 'sk_live_4eC39HqLyjWDarjtT1zdp7dc'
Test using Github Actions
Input
repo-name
The name of the repository where you are calling this actions
Required This input is required for the action to run
Example usage
uses: felixfaisal/attack-on-web-actions@v2.0
with:
repo-name: 'my-repo'
Contributing
To contribute, please find the contribution guidelines here - Contribution Guidelines
License
MIT