External Command Authentication

Overview

If you have your own script to perform authentication to your application, HawkScan can use that script to authenticate. For example, a bash script that runs a curl command to your authentication server.

To support this type of authentication, HawkScan supports externally supplying authorization scripts with the authentication.externalCommand configuration.

The authentication section of the stackhawk.yml will have 3 parts:

Logged in/out indicators
- How HawkScan checks it is logged in throughout the scan.
Auth(N)
- Using authentication.externalCommand to tell HawkScan the command to run.
Test Path
- How HawkScan sees if it successfully logged in

Make sure your file has all 3 of these parts filled out.

YAML for External Command Credentials

Running shell script:

stackhawk.yml

app:
  applicationId: xxXXXXXX-xXXX-xxXX-XXxX-xXXxxXXXXxXX
  env: Test
  host: ${APP_HOST:http://localhost:3000}
  authentication:
    # Paths that HawkScan checks to see if it is still logged in during the scan
    loggedInIndicator: "HTTP.*2[0-9][0-9]\\s*O[kK](\\s*)|HTTP.*3[0-9][0-9].*" # Change me
    loggedOutIndicator: "HTTP.*4[0-9][0-9](\\s*)Unauthorized.*" # Change me
    # Auth(N) External Command - this example will result in 2 cookies based upon the specified shell script.
    externalCommand:
      # Command to run process, in this case a shell script.
      command: "sh"
      # Optional list of parameters that will be added to the specified command.
      parameters:
        - "-c"
        - "./multi-cookie.sh"
    # A path that can only be seen when successfully logged in. HawkScan will check this path to see if log in was successful.
    testPath:
      path: /mysettings
      success: ".*200.*"
      requestMethod: GET

YAML Sections in Detail

Injecting Authorization with `.externalCommand`

The first half of your authentication section in your stackhawk.yml will be to tell HawkScan you are using an externally supplied command.

The .command should be the first argument of the command you wish to run e.g. sh or python.

The .parameters section is an optional list of parameters to add to the command. In this case it specifies what shell script to run.