bulwark - An organizational asset and vulnerability manageme

项目说明

<p align="center">
<img width="350" src="frontend/src/assets/logo.png">
</p>

<p style="text-align: center;">An organizational asset and management tool, with Jira integration, designed for generating application security reports.</p>

<p align="center">
<img src='
<img src='
<img src='
<img src='
<img src='
</p>

Features

Note

Please keep in mind, this project is in early de.

Demo

!Bulwark Walkthrough Demo

Jira Integration

!Bulwark Jira Demo

Launch with Docker

1. Install Docker
2. Create a .env file and supply the following properties:

Build and start Bulwark containers:

Start/Stop Bulwark containers:

Remo containers:

Bulwark will be a at localhost:4500

Local Installation

Running npm install will install both ser and client-side modules. Furthermore, it will run the script npm run config which will dynamically set the en in addition to updating the Angular en.

De Mode

Set NODE_ENV="de"

Production Mode

Set NODE_ENV="production"
_Please note: npm install will automatically build in production mode_

En

Create a .env file on the root directory. This will be parsed with dotenv by the application.

#### DB_PASSWORD

DB_PASSWORD="somePassword"

Set this to database password

#### DB_USERNAME

DB_USERNAME="foobar"

Set this to database user name

#### DB_URL

DB_URL=something-foo-bar.dbnet

Set this to database URL

#### DB_PORT

DB_PORT=3306

Set this to database port

#### DB_NAME

DB_NAME="foobar"

Set this to database connection name

#### DB_TYPE

DB_TYPE="mysql"

The application was de using a MySQL database. See the typeorm documentation for more database options.

#### NODE_ENV

NODE_EN

Set this to determine node en

#### DEV_URL="

Used by Angular to build and serve the application

#### SER="

Update if a different ser is required

#### PORT=4500

Update if a different server port is required

#### JWT_KEY

JWT_KEY="changeMe"

Set this to the JWT secret

#### JWT_REFRESH_KEY

JWT_REFRESH_KEY="changeMe"

Set this to the refresh JWT secret

#### CRYPTO_SECRET

CRYPTO_SECRET="randomValue"

Set this to the Scrypt password.

#### CRYPTO_SALT

CRYPTO_SECRET="randomValue"

Set this to the Scrypt salt.

Empty .env file template

Note on M1/M2 Macs

Create Initial Database Migration

1. Create the initial database migration

2. Run the initial database migration

Default credentials

A user account is created on initial startup with the following credentials:

Upon first login, update the default user password under the profile section.

Roles

The application utilizes least pri access with team-based authorization. Teams are assigned a role which determines the features a to that specific team. A user will inherit roles from team membership. Administrators have team management access and must assign users to teams. Initially, users are created with no team association and will not ha to any features in the application.

The three roles include:

1. Admin
2. Tester
3. Read-Only

A team can only be associated to a single organization. However, a team can be associated to multiple assets within the same organization. A user can be a member of multiple teams. If a user is assigned to multiple teams of the same organization, the system will choose the highest authorized team.

_Please note: The default user is automatically assigned to the Administrators team on initial startup_

Role Matrix

<table>
<tr>
<td></td>
<th scope="col">Admin</th>
<th scope="col">Tester</th>
<th scope="col">Read-Only</th>
</tr>
<tr>
<th scope="row">User-Profile Management</th>
<td>x</td>
<td>x</td>
<td>x</td>
</tr>
<tr>
<th scope="row">Team Management</th>
<td>x</td>
<td></td>
<td></td>
</tr>
<tr>
<th scope="row">User Management</th>
<td>x</td>
<td></td>
<td></td>
</tr>
<tr>
<th scope="row">Invite User</th>
<td>x</td>
<td></td>
<td></td>
</tr>
<tr>
<th scope="row">Create User</th>
<td>x</td>
<td></td>
<td></td>
</tr>
<tr>
<th scope="row">Email Settings Management</th>
<td>x</td>
<td></td>
<td></td>
</tr>
<tr>
<th scope="row">Jira Integration</th>
<td>x</td>
<td></td>
<td></td>
</tr>
<tr>
<th scope="row">Organization: Read</th>
<td>x</td>
<td>x</td>
<td>x</td>
</tr>
<tr>
<th scope="row">Organization: Full Write</th>
<td>x</td>
<td></td>
<td></td>
</tr>
<tr>
<th scope="row">Asset: Read</th>
<td>x</td>
<td>x</td>
<td>x</td>
</tr>
<tr>
<th scope="row">Asset: Full Write</th>
<td>x</td>
<td></td>
<td></td>
</tr>
<tr>
<th scope="row">Assessment: Read</th>
<td>x</td>
<td>x</td>
<td>x</td>
</tr>
<tr>
<th scope="row">Assessment: Full Write</th>
<td>x</td>
<td>x</td>
<td></td>
</tr>
<tr>
<th scope="row">: Read</th>
<td>x</td>
<td>x</td>
<td>x</td>
</tr>
<tr>
<th scope="row">: Full Write</th>
<td>x</td>
<td>x</td>
<td></td>
</tr>
<tr>
<th scope="row">Export to Jira</th>
<td>x</td>
<td>x</td>
<td></td>
</tr>
<tr>
<th scope="row">Report Generation</th>
<td>x</td>
<td>x</td>
<td>x</td>
</tr>
</table>

<br>

API Key & Management

A user may generate a single API key which can be used in place of their authorization token. This API key allows for all actions against the application that the user is authorized for.

Generating an API key pair

1. Login to the application
2. Na to the User Profile section
3. Select Generate API Key

This action will generate a pair of keys:

1. Bulwark-Api-Key
1. This is a generated plaintext value to identify the user.
2. Bulwark-Secret-Key
1. This is a generated plaintext value to the user by comparing a Bcrypt hash stored in the database.

<strong>Write down the generated keys in a safe place. You will not be able to retrieve the keys at a later time.</strong>

How to use API keys

The API key pair must be matched and appended to the following HTTP request headers:

Example:

Built With

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change. Read the contribution guidelines for more information.

License

MIT

项目信息

开发语言：TypeScript

Star 数：187

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An organizational asset and vulnerability management tool, with Jira integration, designed for generating application security reports.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。