jackhammer - Jackhammer - One Security vulnerability assessment

项目说明

Jackhammer:

What is Jackhammer?

Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and track the quality of the code going into production. It could do static code analysis and dynamic analysis with inbuilt management capability. It finds security in the target applications and it helps security teams to manage the chaos in this new age of continuous integration and continuous/multiple deployments.

It completely works on RBAC (Role Based Access Control). There are cool dashboards for indi scans and team scans giving ample flexibility to collaborate with different teams. It is totally built on pluggable architecture which can be integrated with any open source/commercial tool.

Jackhammer uses the OWASP pipeline project to run multiple open source and commercial tools against your code,web app, mobile app, cms (wordpress), network.

Key Features:

* Provides unified interface to collaborate on findings
* Scanning (code) can be done for all code management repositories
* Scheduling of scans based on intervals # daily, weekly, monthly
* Ad false positi
* Publish to bug tracking systems
* Keep a tab on statistics and trends in your applications
* Integrates with majority of open source and commercial scanning tools
* Users and Roles management giving greater control
* Configurable se levels on list of findings across the applications
* Built-in status progression
* Easy to use filters to review targeted sets from tons of
* Asynchronous scanning () that scale
* Seamless Management
* Track statistics and graph security trends in your applications
* Easily integrates with a of open source, commercial and custom scanning tools

Supported Scanners:

Static Analysis:

* [Brakeman][]
* [Bundler-Audit][]
* [Dawnscanner][]
* [FindSecurityBugs][]
* [Xanitizer*][]
* [NodeSecurityProject][]
* [Retire.js][]

   * license required
     ** commercial license required

Finding hard coded secrets/tokens/creds:

* [Trufflehog][] (Slightly modified/extended for better result and integration as of May 2017)

Webapp:

* [Arachni][]

Mobile App:

* [Androbugs][] (Slightly modified/extended for better result and integration as of May 2017)
* [Androguard][] (Slightly modified/extended for better result and integration as of May 2017)

Wordpress:

* [WPScan][] (Slightly modified/extended for better result and integration as of May 2017)

Network:

* [Nmap][]

Adding Custom (other open source/commercial /personal) Scanners:

You can add any scanner to jackhammer within 10-30 minutes. Check the links/video

Quick Start and Installation

See our [Quick Start/Installation Guide][] if you want to try out Jackhammer as quickly as possible using Docker Compose.

##### Run the following commands for local setup (corporate mode):

##### Default credentials for local setup:

username:

password: j4ckh4mm3r

##### (For single user mode)

do signup for access

Restarting Jackhammer

User Guide

The [User Guide][] will give you an o of how to use Jackhammer once you ha up and running.

Demo

##### Demo En Link:

##### Default credentials:

username:

password:

[Brakeman]:
[Bundler-Audit]:
[Dawnscanner]:
[FindSecurityBugs]:
[Xanitizer*]:
[NodeSecurityProject]:
[Retire.js]:
[Trufflehog]:
[Arachni]:
[Androbugs]:
[Androguard]:
[Nmap]:
[WPScan]:
[User Guide]:
[Quick Start/Installation Guide]:

项目信息

开发语言：Java

Star 数：738

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。