Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update agent doc. #276

Merged
merged 1 commit into from
Mar 28, 2022
Merged

update agent doc. #276

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions docs/doc/AgentDebug.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
# Agent 调试

1. 构建好即将调试的 Agent，构建方式请查看 [Agent 构建]()
2. 使用 IDE 打开 Agent 代码，推荐 IntelliJ IDEA

3. 使用 Remote JVM Debug 功能

![springtest_config](/Users/erzhuangniu/Documents/png/springtest_config.png)

4. 进行配置

![remote_debug](/Users/erzhuangniu/Documents/png/remote_debug.png)

参数：

```
Host：运行该项目的远程IP
Port：远程 IP 的端口
Command：远程主机在启动 Java 应用时需要添加的参数
```

5. 配置应用的启动命令

```
java -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005 -javaagent:/path/to/dongtai-agent.jar -Ddongtai.debug=true -jar app.jar
```

- -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005：JVM Remote Debug 参数
- -javaagent:/path/to/agent.jar：被远程 Debug 的DongTAi-iast-agent
- -Ddongtai.debug=true：使用本地的 agent 包
- app.jar 使用 agent 启动的 JAVA 应用

6. 返回 IDEA 界面，点击 debug 启动标志开始调试 Agent
39 changes: 39 additions & 0 deletions docs/doc/ConfigurationProperties.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# 配置参数

## 手动安装

| Property name | Description | Value Type | Default |
| ------------------------- | :-------------------------------------------------------- | --------------- | --------------------- |
| `dongtai.app.name` | 设置项目名称 | String | Demo proJect |
| `dongtai.app.version` | 设置项目版本 | String | V1.0 |
| `dongtai.app.create` | 设置是否自动创建项目 | Boolean | false |
| `dongtai.debug` | 开启后加载本地系统临时目录中的检测引擎 | Boolean | false |
| `iast.server.mode` | local模式支持、POST请求包展示、污点位置及污点值展示等功能 | local \| remote | local |
| `iast.proxy.enable` | HTTP代理模式是否启用 | Boolean | false |
| `iast.proxy.host` | HTTP 代理的域名 (IP) | String | null |
| `iast.proxy.port` | HTTP 代理的端口 | String | 80 |
| `iast.engine.delay.time` | 延迟启动功能，单位：秒 | Integer | 0 |
| `iast.dump.class.enable` | 是否 dump 修改后的字节码 | Boolean | false \| true |
| `iast.dump.class.path` | dump 字节码的路径 | Boolean | /tmp/iast-class-dump/ |
| `dongtai.server.url` | Dongtai OpenAPI Url | String | |
| `dongtai.server.token` | Dongtai OpenAPI Token | String | |
| `dongtai.response.length` | 向 Dongtai OpenAPI 发送的响应体长度 | Integer | null |
| `dongtai.log` | 是否把日志输出到本地文件 | Boolean | true |
| `dongtai.log.path` | 指定日志文件所在目录 | String | agent.jar 当前目录 |
| `dongtai.log.level` | 指定日志等级 | String | info |
| `dongtai.server.package` | 指定是否从洞态Server端下载agent依赖包 | boolean |`true`, `false` | true |



## 自动安装

| Property name | Description | Value Type | Optional |
| ---------------- | -------------------------------------- | ---------- | -------------------- |
| `app_name` | 设置项目名称 | String | proJect name |
| `app_create` | 设置是否自动创建项目 | Boolean | true \| false |
| `app_version` | 设置项目版本 | String | V1.0 |
| `debug` | 开启后加载本地系统临时目录中的检测引擎 | Boolean | true \| false |
| `dongtai_server` | Dongtai OpenAPI Url | String | |
| `dongtai_token` | Dongtai OpenAPI Token | String | |
| `mode` | agent 加载/卸载 | String | install \| uninstall |
| `pid` | 应用程序进程 ID | String | |
62 changes: 62 additions & 0 deletions docs/doc/DetectionCapability.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
# 检测能力

#### 通用漏洞类型

| 漏洞名称 | 漏洞等级 |
| ------------------------------------------------------------ | -------- |
| Sql 注入 | 高危 |
| 文件包含 | 高危 |
| ORM Injection | 高危 |
| JNI 注入 | 高危 |
| LDAP 注入 | 高危 |
| NoSql 注入 | 高危 |
| SMTP 注入 | 高危 |
| XPath 注入 | 高危 |
| 反射注入 | 高危 |
| 表达式注入（EL Injection） | 高危 |
| OGNL 注入 | 高危 |
| JNDI 注入 | 高危 |
| Groovy 注入 | 高危 |
| 命令执行 | 高危 |
| 不安全的反序列化 | 高危 |
| 服务器端请求伪造（SSRF） | 高危 |
| 路径穿越（任意文件上传、任意文件读取、任意文件写入、任意文件删除等） | 高危 |
| 代码执行 | 高危 |
| 硬编码检测 | 高危 |
| 敏感信息泄漏 | 高危 |
| 不安全的XML Decode | 中危 |
| XXE | 中危 |
| Header 头注入 | 中危 |
| 反射型 XSS | 中危 |
| 存储型 XSS | 中危 |
| CORS misconfiguration | 低危 |
| 数据明文传输 | 低危 |
| 弱加密算法（weak cryptographic algorithms） | 低危 |
| 弱哈希算法 | 低危 |
| 弱随机数算法 | 低危 |
| 点击劫持 | 低危 |
| 正则 Dos | 低危 |
| 不安全的 readline | 低危 |
| 信任边界 | 低危 |
| Cookie 未设置 Secure | 提示 |
| 硬编码检测 | 提示 |
| 手机号码泄露 | 提示 |
| Response Without X-Content-Type-Options Header | 提示 |
| Pages Without Anti-Clickjacking Controls | 提示 |
| Response With Insecurely Configured Strict-Transport-Security Header | 提示 |
| Response With X-XSS-Protection Disabled | 提示 |
| Response Without Content-Security-Policy Header | 提示 |
| 不安全的转发 | 低危 |
| 不安全的重定向 | 低危 |
| 不安全的readline | 低危 |
| HQL注入 | 高危 |

#### 跨请求漏洞

| 漏洞名称 | 漏洞等级 | 是否支持检测 |
| ------------ | -------- | ------------ |
| 漏洞链路追踪 | 高危 | 已支持 |
| 未授权访问 | 高危 | |
| 水平越权 | 高危 | |
| 垂直越权 | 高危 | |

12 changes: 12 additions & 0 deletions docs/doc/Index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# DongTai Java Agent

**这是 DongTai Java Agent 的开发文档，欢迎加入洞态开发者社区。**

在这篇文档里你将了解到关于 DongTai Java Agent 的：

- [Agent 功能](https://hxsecurity.github.io/DongTai-agent-java/doc/UsageScenarios.md)
- [支持环境](https://hxsecurity.github.io/DongTai-agent-java/doc/Support.md)
- [Agent 架构](https://hxsecurity.github.io/DongTai-agent-java/doc/ProductStructure.md)
- [构建部署](https://hxsecurity.github.io/DongTai-agent-java/doc/MavenBuild.md)
- [Agent 调试](https://hxsecurity.github.io/DongTai-agent-java/doc/AgentDebug.md)
- [配置参数](https://hxsecurity.github.io/DongTai-agent-java/doc/ConfigurationProperties.md)
40 changes: 40 additions & 0 deletions docs/doc/MavenBuild.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
# 构建部署

1. 确保你的计算机安装了 JDK8 和 maven

2. 克隆 [DongTai-agent-java](https://github.com/HXSecurity/DongTai-agent-java)

3. 修改配置文件`dongtai-agent/src/main/resources/iast.properties`，更改以下关于服务端配置：

```
iast.server.url=
iast.server.token=
```

4. 在项目根目录执行：

```
mvn clean package -Dmaven.test.skip=true
```

5. 在项目根目录会生成文件夹 `release`：

```
release
├── dongtai-agent.jar
└── lib
├── dongtai-api.jar
├── dongtai-core.jar
├── dongtai-log.jar
├── dongtai-spring-api.jar
└── dongtai-spy.jar
```

6. 将 `release/lib`目录下的所有`.jar`文件放入系统临时目录

7. 启动前添加参数 `-Ddongtai.debug=true`，例：

```
java -javaagent:/path/to/dongtai-agent.jar -Ddongtai.debug=true -jar app.jar
```

Loading