archerysec - ASOC, ASPM, DevSecOps, Vulnerability Management Us

项目说明

![Follow Archery on Twitter]( "Follow Archery on Twitter")

![PyPI - License]() !PyPI - Django !Tra
![CII Best Practices]()

![Road Map]() ![BlackHat USA Arsenal 2018]() ![BlackHat Asia Arsenal 2018]() ![DEFCON 26 Demolabs]()

Support.

*Paypal:* ![Donate ]()

Archery
=================

ArcherySec allow to interact with continuous integration/continuous delivery (CI/CD) toolchains to specify testing, and control the release of a gi based on results. Its include prioritization functions, enabling you to focus on the most critical .
ArcherySec uses popular opensource tools to perform comprehensi for web application and network. The de can also utilize the tool for implementation of their DevOps CI/CD en.

Documentation

* Official Website & Documentation
* API Documentation

!Demo

!O

O of the tool

* Perform Web and Network Scanning using opensource tools.
* Correlates and Collaborate all raw scans data, show them in a consolidated manner.
* Perform authenticated web scanning.
* Perform web application scanning using selenium.
* Management.
* Enable REST API's for de to perform scanning and Management.
* JIRA Ticketing System.
* Sub domain discovery and scanning.
* Periodic scans.
* Concurrent scans.
* Useful for DevOps teams for Management.

Requirements

* Python 3.9 - Python 3.9 Download

OpenVAS

You can follow the instructions to install OpenVAS from Hacker Target

Note that, at this time, Archery generates a TCP connection towards the Open (*not the GSA*): therefore, you need to update your Open configuration to bind this port. Its default port (9390/tcp), but you can update this in your settings.

OWASP Zap

Also known as Zaproxy. Simply download and install the matching package for your distro from the official Github Page.

Systemd service file is a in the project.

Burp Scanner

Follow the instruction in order to enable Burp REST API.

* Burp REST API

Configure REST API endpoint in ArcherySec Settings

SSLScan

Simply install SSLScan from your package manager.

Nikto

Simply install Nikto from your package manager.

NMAP

Simply get the NSE file to the proper directory:

* DO NOT EXPOSE PUBLICLY, INTERNAL USE ONLY **

#### Restrict ArcherySec signup page on production.

Installation

export TIME_ZONE='Asia/Kolkata'

Windows installation

set TIME_ZONE='Asia/Kolkata'

Note on installation for de and contributors

If you wish to contribute to the project, make sure you are using requirements-dev.txt and run this command once you ha the requirements

This will automatically check for code linting and rules used on this project and if e is correct, the commit will be made.

Note on manual and automated installation

If you are running the code directly without setting DJANGO_SETTINGS_MODULE, this will default to using archerysec.settings.base. all defaults will be used in this case and for customizing options you can copy local_settings.sample.py to local_settings.py

Docker option should use en to set different settings of the container.

Docker Installation

ArcherySec Docker is a from ArcherySec Docker

Using ArcherySec through docker compose

This is the simplest way to get things running. For the time being the docker-compose.yml is focused on de configuration but with some changes you can get a production ready definition.

Running the following command will get you all the services up, creates a postgres db and connects ArcherySec with it.

Configure Ser on AWS

Deploy ArcherySec as a Ser on AWS using Zappa

En for this project <!-- omit in toc -->

The following en are used to change behaviour of the container settings

#### TIME_ZONE

export TIME_ZONE='Asia/Kolkata'

#### DB_PASSWORD <!-- omit in toc -->

Database password for the postgres db server

#### DB_USER <!-- omit in toc -->

Database user for the postgres db server

#### DB_NAME <!-- omit in toc -->

Database name for the postgres db server

#### DJANGO_SETTINGS_MODULE <!-- omit in toc -->

Django setting to use. currently this can be set to archerysecurity.settings.de or archerysecurity.settings.production depending on your needs

#### DJANGO_SECRET_KEY <!-- omit in toc -->

Always generate and set a secret key for you project. Tools like this one can be used for this purpose

#### DJANGO_DEBUG <!-- omit in toc -->

Set this to 1 if debug should be enabled

#### ARCHERY_WORKER <!-- omit in toc -->

This is used to tell the container it has to behave as a worker to process tasks
and not as a web ser on port 8000. Set it to True if you want to run on
this mode.

#### EMAIL_HOST

export EMAIL_HOST='smtp.xxxxx.com'

#### EMAIL_USE_TLS

export EMAIL_USE_TLS=True

Set this to True or False

#### EMAIL_PORT

export EMAIL_PORT=587

Set this to SMTP port.

#### EMAIL_HOST_PASSWORD

export EMAIL_HOST_PASSWORD='password'

Set this to SMTP Password.

#### EMAIL_HOST_USER

export EMAIL_HOST_USER=''

Set this to SMTP Email.

Setup third-party integrations

ZAP running daemon mode

Locate your ZAP startup script, and execute it using the options detailed below.

Windows :

Others :

Zap Setting

1. Go to Setting Page
2. Edit ZAP setting or na URL :
3. Fill below required information.
+ Zap API Key: Lea if you using ZAP as daemon api.disablekey=true
+ Zap API Host: Your zap API host ip or system IP Ex. 127.0.0.1 or 192.168.0.2
+ Zap API Port: ZAP running port Ex. 8080

Open

1. Go to setting Page
2. Edit Open or na URL:
3. Fill all required information and click on save.

Road Map

* Scanners parser & Plugin
- [x] Nessus (XML)
- [x] Webinspect (XML)
- [x] Acunetix (XML)
- [x] Netsparker (XML)
- [x] OWASP ZAP (XML) & (Plugin)
- [x] Burp Pro Scanner (XML)
- [x] Arachni (XML) & (Plugin)
- [x] OpenVAS (XML) & (Plugin)
- [x] Bandit Scan (XML)
- [x] Dependency Check (XML)
- [x] FindBugs (XML)

More Scanners

Lead De

Anand Tiwari

Social Media

* Official Website
* Twitter
* Facebook

项目信息

开发语言：JavaScript

Star 数：2478

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕ASOC, ASPM, DevSecOps, Vulnerability Management Using ArcherySec.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。