bmt 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '040904fc39790bbaa2e13d8fcb1894d0bdb7f380ce08a7a776c375be21ba47d7'
-  data.tar.gz: 7585f36949be01298afb26f799a0bcf991b7b699b8619a482e32289f3626d2c0
+  metadata.gz: 04a87568e5dfa59d4a18684155a94887ee5269d1c21616385ce597a61a02ed98
+  data.tar.gz: d7b6fc9115319bb9c2e81b2365142cb74f1c1da96464c29ea9e996c5e59e41e0
 SHA512:
-  metadata.gz: f266fa46ced81e902c2be218b40b06cfcf4dc008a17446e0fbd795b964a11662cab74454c20d79473ebe35b7b2201cf6c84b2808d2a65d30fc4e19ccc541b2e6
-  data.tar.gz: 9492beea14f985570dc4a002f851ea4fa976274497032de91c1f3ddff6af65b6fa2d87d80a343c141b316415da19abd12071d2b6bdccff51fe81de09abb0b037
+  metadata.gz: 59f5897bffa150a4d9aa10a833e63f1976220f8a8de160593586abd2cf19c0bc06fc9ec7fcb93838a0ef84a2786d34638d2681e4172fadfcadca834cb87c303e
+  data.tar.gz: e320d79c9bb6f845f34843b73d3ae08739db6339b3beb68e179a16dbc38d5bb189c7423cd927027b057902f99335888e7a3e479b5dd7bb4e8b0f702ba99c6e97

data/lib/bmt/step.rb

@@ -1,13 +1,14 @@
 module BMT
   class Step
-    attr_reader :key, :title, :description, :methodology
+    attr_reader :key, :title, :description, :methodology, :type
 
     def initialize(methodology:, attributes:)
       @methodology = methodology
       @key = attributes['key']
       @title = attributes['title']
       @description = attributes['description']
-      @items_data = attributes['items']
+      @type = attributes['type']
+      @items_data = attributes['items'] || []
     end
 
     def items

data/lib/bmt/version.rb

@@ -1,3 +1,3 @@
 module Bmt
-  VERSION = '0.2.0'.freeze
+  VERSION = '0.3.0'.freeze
 end

data/lib/data/0.1/methodologies/template.json

@@ -11,6 +11,7 @@
         "key": "koala",
         "title": "Check that you have a Koala",
         "description": "# Does it look like one?\nIt is easy to find out.\n",
+        "type": "checklist",
         "items": [
           {
             "key": "marsupial",
@@ -40,6 +41,7 @@
         "key": "kangaroo",
         "title": "Ensure you have a kangaroo",
         "description": "Does it look like one?",
+        "type": "checklist",
         "items": [
           {
             "key": "marsupial",
@@ -63,6 +65,18 @@
             "tools": "Field, Trampoline"
           }
         ]
+      },
+      {
+        "key": "upload_logs",
+        "title": "Upload logs",
+        "description": "This should include all associated traffic associated to the in-scope targets.",
+        "type": "large_upload"
+      },
+      {
+        "key": "executive_summary",
+        "title": "Executive summary",
+        "description": "The executive summary should be written with a high-level view of both risk and business impact. It should be concise and clear, therefore it is important to use plain English. This ensures that non-technical readers can gain insight into security concerns outlined in your report.",
+        "type": "executive_summary"
       }
     ]
   }

data/lib/data/0.1/methodologies/website_testing.json

@@ -11,6 +11,7 @@
         "key": "information",
         "title": "Information gathering",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "search_engine_discovery_and_reconnaissance",
@@ -91,6 +92,7 @@
         "key": "config_and_deploy_management",
         "title": "Configuration and Deploy Management Testing",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "network_and_infrastructure",
@@ -161,6 +163,7 @@
         "key": "identity_management",
         "title": "Identity Management Testing",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "role_definition",
@@ -223,6 +226,7 @@
         "key": "authentication",
         "title": "Authentication Testing",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "encrypted_credentials",
@@ -309,6 +313,7 @@
         "key": "authorization",
         "title": "Authorization Testing",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "directory_traversal_and_file_include",
@@ -348,6 +353,7 @@
         "key": "session_management",
         "title": "Session Management Testing",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "bypass_schema",
@@ -419,6 +425,7 @@
         "key": "data_validation",
         "title": "Data Validation Testing",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "reflected_xss",
@@ -630,6 +637,7 @@
         "key": "error_handling",
         "title": "Error handling",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "error_codes",
@@ -653,6 +661,7 @@
         "key": "cryptography",
         "title": "Cryptography",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "transport_layer_protection",
@@ -684,6 +693,7 @@
         "key": "business_logic",
         "title": "Business Logic Testing",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "data_validation",
@@ -761,6 +771,7 @@
         "key": "client_side",
         "title": "Client Side Testing",
         "description": "",
+        "type": "checklist",
         "items": [
           {
             "key": "dom_based_xss",
@@ -857,6 +868,18 @@
             "tools": "Chrome, Firebug, Burp Proxy, ZAP"
           }
         ]
+      },
+      {
+        "key": "upload_logs",
+        "title": "Upload logs",
+        "description": "This should include all associated traffic associated to the in-scope targets.",
+        "type": "large_upload"
+      },
+      {
+        "key": "executive_summary",
+        "title": "Executive summary",
+        "description": "The executive summary should be written with a high-level view of both risk and business impact. It should be concise and clear, therefore it is important to use plain English. This ensures that non-technical readers can gain insight into security concerns outlined in your report.",
+        "type": "executive_summary"
       }
     ]
   }

data/lib/data/0.1/schema.json

@@ -78,6 +78,10 @@
         "description": {
           "type": "string"
         },
+        "type": {
+          "type": "string",
+          "enum": ["checklist", "large_upload", "executive_summary"]
+        },
         "items": {
           "type": "array",
           "items": {
@@ -89,7 +93,7 @@
         "key",
         "title",
         "description",
-        "items"
+        "type"
       ]
     }
   },

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bmt
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Federico Tagliabue
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-11-25 00:00:00.000000000 Z
+date: 2021-12-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler