devsecops-engine-tools 1.32.5__tar.gz → 1.33.1__tar.gz

{devsecops_engine_tools-1.32.5 → devsecops_engine_tools-1.33.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.32.5
+Version: 1.33.1
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -28,6 +28,9 @@ Requires-Dist: setuptools==72.1.0
 Requires-Dist: rich==13.9.4
 Requires-Dist: cpe==1.3.1
 Requires-Dist: packageurl-python==0.15.6
+Requires-Dist: ruamel.yaml==0.18.6
+Requires-Dist: Authlib==1.3.2
+Requires-Dist: PyJWT==2.9.0
 
 # DevSecOps Engine Tools
 
@@ -71,7 +74,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"] --dast_file_path ["dast_file_path"]
 ```
 
 ### Structure Remote Config
@@ -83,6 +86,9 @@ devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_con
    ┣ 📂engine_risk
    ┃ ┗ 📜ConfigTool.json
    ┃ ┗ 📜Exclusions.json
+   ┣ 📂engine_dast
+   ┃ ┗ 📜ConfigTool.json
+   ┃ ┗ 📜Exclusions.json
    ┣ 📂engine_sast
    ┃ ┗ 📂engine_iac
    ┃   ┗ 📜ConfigTool.json

{devsecops_engine_tools-1.32.5 → devsecops_engine_tools-1.33.1}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -170,6 +170,12 @@ def get_inputs_from_cli(args):
         required=False,
         help="Name of image to scan for engine_container",
     )
+    parser.add_argument(
+        "--dast_file_path",
+        required=False,
+        help="File path containing the configuration, structured according to the documentation, \
+        for the API or web application to be scanned by the DAST tool."
+    )
     args = parser.parse_args()
     return {
         "platform_devops": args.platform_devops,
@@ -187,7 +193,8 @@ def get_inputs_from_cli(args):
         "token_engine_dependencies": args.token_engine_dependencies,
         "token_external_checks": args.token_external_checks,
         "xray_mode": args.xray_mode,
-        "image_to_scan": args.image_to_scan
+        "image_to_scan": args.image_to_scan,
+        "dast_file_path": args.dast_file_path
     }
 
 

{devsecops_engine_tools-1.32.5 → devsecops_engine_tools-1.33.1}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_scan.py

@@ -36,10 +36,12 @@ from devsecops_engine_tools.engine_sca.engine_container.src.applications.runner_
 from devsecops_engine_tools.engine_sca.engine_dependencies.src.applications.runner_dependencies_scan import (
     runner_engine_dependencies,
 )
+from devsecops_engine_tools.engine_dast.src.applications.runner_dast_scan import (
+    runner_engine_dast
+)
 from devsecops_engine_tools.engine_core.src.infrastructure.helpers.util import (
     define_env,
 )
-
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 
@@ -98,7 +100,16 @@ class HandleScan:
             )
             return findings_list, input_core
         elif "engine_dast" in dict_args["tool"]:
-            print(MESSAGE_ENABLED)
+            findings_list, input_core = runner_engine_dast(
+                dict_args,
+                config_tool["ENGINE_DAST"],
+                secret_tool,
+                self.devops_platform_gateway
+            )
+            self._use_vulnerability_management(
+                config_tool, input_core, dict_args, secret_tool, env
+            )
+            return findings_list, input_core
         elif "engine_code" in dict_args["tool"]:
             findings_list, input_core = runner_engine_code(
                 dict_args,

{devsecops_engine_tools-1.32.5 → devsecops_engine_tools-1.33.1}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -82,7 +82,8 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 "BEARER": "Bearer CLI",
                 "DEPENDENCY_CHECK": "Dependency Check Scan",
                 "SONARQUBE": "SonarQube API Import",
-                "GITLEAKS": "Gitleaks Scan"
+                "GITLEAKS": "Gitleaks Scan",
+                "NUCLEI": "Nuclei Scan"
             }
 
             if any(

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/applications/runner_dast_scan.py

@@ -0,0 +1,100 @@
+from typing import List
+from devsecops_engine_tools.engine_dast.src.infrastructure.entry_points.entry_point_dast import (
+    init_engine_dast,
+)
+from devsecops_engine_tools.engine_dast.src.infrastructure.driven_adapters.nuclei.nuclei_tool import (
+    NucleiTool,
+)
+from devsecops_engine_tools.engine_dast.src.infrastructure.driven_adapters.jwt.jwt_object import (
+    JwtObject,
+)
+from devsecops_engine_tools.engine_dast.src.infrastructure.driven_adapters.jwt.jwt_tool import (
+    JwtTool,
+)
+from devsecops_engine_tools.engine_dast.src.infrastructure.driven_adapters.oauth.generic_oauth import (
+    GenericOauth,
+)
+from devsecops_engine_tools.engine_dast.src.infrastructure.driven_adapters.http.client.auth_client import (
+    AuthClientCredential,
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.api_config import (
+    ApiConfig
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.api_operation import (
+    ApiOperation
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.wa_config import (
+    WaConfig
+)
+from devsecops_engine_tools.engine_dast.src.infrastructure.helpers.json_handler import (
+    load_json_file
+)
+
+def runner_engine_dast(dict_args, config_tool, secret_tool, devops_platform_gateway):
+    if config_tool["TOOL"].lower() == "nuclei": # tool_gateway is the main Tool
+        tool_run = NucleiTool()
+    extra_tools = []
+    target_config = None
+
+    # Filling operations list with adapters
+    data = load_json_file(dict_args["dast_file_path"])
+
+    try:
+        if "operations" in data: # Api
+            operations: List = []
+            for elem in data["operations"]:
+                security_type = elem["operation"]["security_auth"]["type"].lower()
+                if security_type == "jwt":
+                    operations.append(
+                        ApiOperation(
+                            elem,
+                            JwtObject(
+                                elem["operation"]["security_auth"]
+                            )
+                        )
+                    )
+                elif security_type == "oauth":
+                    operations.append(
+                        ApiOperation(
+                            elem,
+                            GenericOauth(
+                                elem["operation"]["security_auth"],
+                                data["endpoint"]
+                            )
+                        )
+                    )
+                else:
+                    operations.append(
+                        ApiOperation(
+                            elem,
+                            AuthClientCredential(
+                                elem["operation"]["security_auth"]
+                            )
+                        )
+                    )
+            data["operations"] = operations
+            target_config = ApiConfig(data)
+        elif "WA" in data: # Web Application
+            if data["data"].get["security_auth"] == "oauth":
+                authentication_gateway =  GenericOauth(
+                        data["data"]["security_auth"]
+                    )
+            target_config = WaConfig(data, authentication_gateway)
+        else:
+            raise ValueError("Can't match if the target type is an api or a web application")
+
+        if any((k.lower() == "jwt") for k in config_tool["EXTRA_TOOLS"]) and any(isinstance(operation.authentication_gateway, JwtObject) for operation in data["operations"] ):
+            extra_tools.append(JwtTool(target_config))
+
+        return init_engine_dast(
+            devops_platform_gateway=devops_platform_gateway,
+            tool_gateway=tool_run,
+            dict_args=dict_args,
+            secret_tool=secret_tool,
+            config_tool=config_tool,
+            extra_tools=extra_tools,
+            target_data=target_config
+        )
+    except Exception as e:
+        raise Exception(f"Error engine_dast: {e}")
+        

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/domain/model/api_config.py

@@ -0,0 +1,13 @@
+from typing import List
+from devsecops_engine_tools.engine_dast.src.domain.model.api_operation import ApiOperation
+
+
+class ApiConfig():
+    def __init__(self, api_data: dict):
+        try:
+            self.target_type: str = "API"
+            self.endpoint: str = api_data["endpoint"]
+            self.rate_limit: str = api_data.get("rate_limit")
+            self.operations: "List[ApiOperation]" = api_data["operations"]
+        except KeyError:
+            raise KeyError("Missing configuration, validate the endpoint and every single operation")

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/domain/model/api_operation.py

@@ -0,0 +1,13 @@
+from devsecops_engine_tools.engine_dast.src.domain.model.gateways.authentication_gateway import (
+    AuthenticationGateway
+)
+class ApiOperation():
+    def __init__(self, operation, authentication_gateway):
+        self.authentication_gateway: AuthenticationGateway = authentication_gateway
+        self.data: dict = operation
+        self.credentials = ("auth_header", "token")
+
+    def authenticate(self):
+        self.credentials = self.authentication_gateway.get_credentials()
+        if self.credentials is not None:
+            self.data["operation"]["headers"][f'{self.credentials[0]}'] = f'{self.credentials[1]}'

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/domain/model/gateways/authentication_gateway.py

@@ -0,0 +1,7 @@
+from abc import ABCMeta, abstractmethod
+
+
+class AuthenticationGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def get_credentials(self) -> dict:
+        "get_credentials"

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/domain/model/gateways/tool_gateway.py

@@ -0,0 +1,9 @@
+from abc import ABCMeta, abstractmethod
+
+
+class ToolGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def run_tool(
+        self, target_data, config_tool, secret_tool, secret_external_checks, agent_work_folder
+    ) -> str:
+        "run_tool"

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/domain/model/wa_config.py

@@ -0,0 +1,10 @@
+class WaConfig:
+    def __init__(self, data: dict, authentication_gateway):
+        self.target_type: str = "WA"
+        self.url: str = data["endpoint"]
+        self.data: dict = data.wa_data
+
+    def authenticate(self):
+        self.credentials = self.authentication_gateway.get_credentials()
+        if self.credentials is not None:
+            self.data["headers"][self.credentials[0]] = self.credentials[1]

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/domain/usecases/dast_scan.py

@@ -0,0 +1,128 @@
+from typing import (
+    List, Tuple, Any
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import (
+    InputCore,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.exclusions import (
+    Exclusions,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
+
+class DastScan:
+    def __init__(
+        self,
+        tool_gateway: ToolGateway,
+        devops_platform_gateway: DevopsPlatformGateway,
+        data_target,
+        aditional_tools: "List[ToolGateway]"
+    ):
+        self.tool_gateway = tool_gateway
+        self.devops_platform_gateway = devops_platform_gateway
+        self.data_target = data_target
+        self.other_tools = aditional_tools
+
+    def complete_config_tool(
+        self, data_file_tool, exclusions, tool
+    ) -> "Tuple[Any, Any]":
+        
+        config_tool = data_file_tool
+
+        config_tool["SCOPE_PIPELINE"] = self.devops_platform_gateway.get_variable(
+            "pipeline_name"
+        )
+
+        config_tool["EXCLUSIONS"] = exclusions
+
+        config_exclusions = config_tool["EXCLUSIONS"]
+
+        if config_exclusions.get("All") is not None:
+            config_tool["EXCLUSIONS_ALL"] = config_exclusions.get("All").get(tool)
+        if config_exclusions.get(config_tool["SCOPE_PIPELINE"]) is not None:
+            config_tool["EXCLUSIONS_SCOPE"] = config_exclusions.get(
+                config_tool["SCOPE_PIPELINE"]
+            ).get(tool)
+
+        data_target_config = self.data_target
+        return config_tool, data_target_config
+
+    def process(
+        self, dict_args, secret_tool, config_tool
+    ) -> "Tuple[List, InputCore]":
+        init_config_tool = self.devops_platform_gateway.get_remote_config(
+            dict_args["remote_config_repo"], "engine_dast/ConfigTool.json"
+        )
+
+        exclusions = self.devops_platform_gateway.get_remote_config(
+            dict_args["remote_config_repo"],
+            "engine_dast/Exclusions.json"
+        )
+
+        agent_work_folder = self.devops_platform_gateway.get_variable("path_directory")
+
+        config_tool, data_target = self.complete_config_tool(
+            data_file_tool=init_config_tool,
+            exclusions=exclusions,
+            tool=config_tool["TOOL"],
+        )
+
+        finding_list, path_file_results = self.tool_gateway.run_tool(
+            target_data=data_target,
+            config_tool=config_tool,
+            secret_tool=secret_tool,
+            secret_external_checks=dict_args["token_external_checks"],
+            agent_work_folder=agent_work_folder
+        )
+
+        #Here execute other tools and append to finding list
+        if len(self.other_tools) > 0:
+            for i in range(len(self.other_tools)):
+                extra_config_tool, data_target = self.complete_config_tool(
+                data_file_tool=init_config_tool,
+                exclusions=exclusions,
+                tool=self.other_tools[i].TOOL
+                )
+                extra_finding_list = self.other_tools[i].run_tool(
+                    target_data=data_target,
+                    config_tool=extra_config_tool
+                )
+                if len(extra_finding_list) > 0:
+                    finding_list.extend(extra_finding_list)
+
+        totalized_exclusions = []
+        (
+            totalized_exclusions.extend(
+                map(
+                    lambda elem: Exclusions(**elem), config_tool.get("EXCLUSIONS_ALL")
+                )
+            )
+            if config_tool.get("EXCLUSIONS_ALL") is not None
+            else None
+        )
+        (
+            totalized_exclusions.extend(
+                map(
+                    lambda elem: Exclusions(**elem),
+                    config_tool.get("EXCLUSIONS_SCOPE"),
+                )
+            )
+            if config_tool.get("EXCLUSIONS_SCOPE") is not None
+            else None
+        )
+
+        input_core = InputCore(
+            totalized_exclusions=totalized_exclusions,
+            threshold_defined=Threshold(config_tool.get("THRESHOLD")),
+            path_file_results=path_file_results,
+            custom_message_break_build=config_tool.get("MESSAGE_INFO_DAST"),
+            scope_pipeline=config_tool.get("SCOPE_PIPELINE"),
+            stage_pipeline=self.devops_platform_gateway.get_variable("stage"),
+        )
+
+        return finding_list, input_core

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/http/client/auth_client.py

@@ -0,0 +1,12 @@
+from devsecops_engine_tools.engine_dast.src.domain.model.gateways.authentication_gateway import (
+    AuthenticationGateway,
+)
+
+
+class AuthClientCredential(AuthenticationGateway):
+    def __init__(self, security_auth: dict):
+        self.client_id: str = security_auth.get("client_id")
+        self.client_secrets: str = security_auth.get("client_secret")
+
+    def get_credentials(self):
+        return None

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_object.py

@@ -0,0 +1,64 @@
+from time import (
+    time
+)
+from secrets import (
+    token_hex
+)
+from authlib.jose import (
+    jwt
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.gateways.authentication_gateway import (
+    AuthenticationGateway,
+)
+
+
+class JwtObject(AuthenticationGateway):
+    def __init__(self, security_auth: dict):
+        self.type = "jwt"
+        self.private_key: str = security_auth.get("jwt_private_key")
+        self.algorithm: str = security_auth.get("jwt_algorithm")
+        self.iss: str = security_auth.get("jwt_iss")
+        self.sum: str = security_auth.get("jwt_sum")
+        self.aud: str = security_auth.get("jwt_aud")
+        self.iat: float = time()
+        self.exp: float = self.iat + 60 * 60
+        self.nonce = token_hex(10)
+        self.payload: dict = {}
+        self.header: dict = {}
+        self.jwt_token: str = ""
+        self.header_name: str = security_auth.get("jwt_header_name")
+        self.init_header()
+        self.init_payload()
+
+    def init_header(self) -> None:
+        self.header: dict = {"alg": self.algorithm}
+
+    def init_payload(self) -> dict:
+        self.payload: dict = {
+            "iss": self.iss,
+            "sum": self.sum,
+            "aud": self.aud,
+            "exp": self.exp,
+            "iat": self.iat,
+            "nonce": self.nonce,
+        }
+        return self.payload
+
+    def get_credentials(self) -> tuple:
+        """
+        Generates JWT using a file with the configuration
+
+        Returns:
+
+        tuple: header and jwt
+
+        """
+        self.private_key = (
+            self.private_key.replace(" ", "\n")
+            .replace("-----BEGIN\nPRIVATE\nKEY-----", "-----BEGIN PRIVATE KEY-----")
+            .replace("-----END\nPRIVATE\nKEY-----", "-----END PRIVATE KEY-----")
+        )
+        self.jwt_token = jwt.encode(self.header, self.payload, self.private_key).decode(
+            "utf-8"
+        )
+        return self.header_name, self.jwt_token

devsecops_engine_tools-1.33.1/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py

@@ -0,0 +1,153 @@
+from typing import (
+    List
+)
+from datetime import (
+    datetime,
+)
+import jwt
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Category,
+    Finding,
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.api_operation import (
+    ApiOperation
+)
+from devsecops_engine_tools.engine_dast.src.infrastructure.helpers.file_generator_tool import (
+    generate_file_from_tool,
+)
+
+class JwtTool(ToolGateway):
+
+    def __init__(self, target_config):
+        self.TOOL = "JWT"
+        self.BAD_JWT_ALG = ["none", "ES256", "ES384", "ES512"]
+        self.BAD_JWS_ALG = ["none", "ES256", "ES384", "ES512"]
+        self.GOOD_JWE_ALG = ["dir", "RSA-OAEP", "RSA-OAEP-256"]
+        self.GOOD_JWE_ENC = ["A256GCM"]
+        self.target_config = target_config
+
+    def verify_jwt_alg(self, token):
+        "Evaluate JSON Web token's algorithm"
+
+        map_id = "JWT_ALGORITHM"
+        alg = jwt.get_unverified_header(token)["alg"]
+
+        if alg in self.BAD_JWT_ALG: #Is vulnerable
+            return {
+                "map_id": map_id,
+                "description": "msg"
+                }
+
+    def verify_jws_alg(self, token):
+        """Evaluate JSON Web signature's algorithm"""
+
+        map_id = "JWS_ALGORITHM"
+        alg = jwt.get_unverified_header(token)["alg"]
+
+        if alg in self.BAD_JWS_ALG:#Is vulnerable
+            return {
+                "map_id": map_id,
+                "description": "msg"
+                }
+
+    def verify_jwe(self, token):
+        """Evaluate JSON Web encryption's algorithm"""
+
+        map_id = "JWE_ALGORITHM"
+        msg = ""
+        enc = jwt.get_unverified_header(token)["enc"]
+        alg = jwt.get_unverified_header(token)["alg"]
+
+        if enc in self.GOOD_JWE_ENC:
+            if alg in self.GOOD_JWE_ALG:# Is not vulnerable
+                return
+            else:
+                msg = "Algorithm: " + alg
+        else:
+            msg = "Encryption: " + enc
+
+        return {
+            "map_id": map_id,
+            "description": msg
+            }
+
+    def check_token(self, token, jwt_details, config_tool):
+        "Validates JWT, JWS or JWE"
+
+        hed = jwt.get_unverified_header(token)
+
+        if "enc" in hed.keys():
+            result = self.verify_jwe(token)
+        elif "typ" in hed.keys():
+            result = self.verify_jwt_alg(token)
+        else:
+            result = self.verify_jws_alg(token)
+
+        if result:
+            mapped_result = {
+                "check_id": config_tool["RULES"][result["map_id"]]["checkID"],
+                "cvss": config_tool["RULES"][result["map_id"]]["cvss"],
+                "matched-at": jwt_details["path"],
+                "description": result["msg"],
+                "severity": config_tool["RULES"][result["map_id"]]["severity"],
+                "remediation": result["remediation"]
+            }
+            return mapped_result
+        return None
+    
+    def configure_tool(self, target_data):
+        """Method for group all operations that uses JWT"""
+        jwt_list: List[ApiOperation] = []
+        for operation in target_data.operations:
+            if operation.authentication_gateway.type.lower() == "jwt":
+                jwt_list.append(operation)
+        return jwt_list
+
+    def execute(self, jwt_config: List[ApiOperation], config_tool):
+        result_scans = []
+        if len(jwt_config) > 0:
+            for jwt_operation in jwt_config:
+                jwt_operation.authenticate()
+                result = self.check_token(token=jwt_operation.credentials[1],
+                                        jwt_details=jwt_operation.data["operation"],
+                                        config_tool=config_tool)
+                if result:
+                    result_scans.append(result)
+        return result_scans
+
+    def get_list_finding(
+        self,
+        result_scan_list: "List[dict]"
+    ) -> "List[Finding]":
+        list_open_findings = []
+        if len(result_scan_list) > 0:
+            for scan in result_scan_list:
+                finding_open = Finding(
+                    id=scan.get("check-id"),
+                    cvss=scan.get("cvss"),
+                    where=scan.get("matched-at"),
+                    description=scan.get("description"),
+                    severity=scan.get("severity").lower(),
+                    identification_date=datetime.now().strftime("%d%m%Y"),
+                    module="engine_dast",
+                    category=Category("vulnerability"),
+                    requirements=scan.get("remediation"),
+                    tool="jwt",
+                    published_date_cve=scan.get("published-cve")
+                )
+                list_open_findings.append(finding_open)
+        return list_open_findings
+
+    def run_tool(self, target_data, config_tool):
+        jwt_config = self.configure_tool(target_data)
+        result_scans = self.execute(jwt_config, config_tool)
+        if result_scans:
+            finding_list = self.get_list_finding(result_scans)
+            path_file_results = generate_file_from_tool(
+                self.TOOL, result_scans, config_tool
+            )
+            return finding_list, path_file_results
+        return []