README
¶
BOAST
BOAST is the BOAST Outpost for AppSec Testing: a server designed to receive and report Out-of-Band Application Security Testing (OAST) reactions.
┌─────────────────────────┐
| BOAST ◄──┐
┌─┤ (DNS, HTTP, HTTPS, ...) | |
│ └─────────────────────────┘ │
│ │
Reactions │ │ Reactions
│ │
│ │
│ │
┌──────▼──────────┐ Payloads ┌────┴────┐
│ Testing client ├──────────────► Target │
└─────────────────┘ └─────────┘
Some application security tests will only trigger out-of-band reactions from the tested applications. These reactions will not be sent as a response to the testing client and, due to their nature, will remain unseen when the client is behind a NAT. To clearly observe these reactions, another component is needed. This component must be freely reachable on the Internet and capable of communicating using various protocols across multiple ports for maximum impact. BOAST is that component.
BOAST features DNS, HTTP, and HTTPS protocol receivers, each supporting multiple simultaneous ports. Implementing protocol receivers for new protocols or customising existing ones to better suit your needs is almost as simple as implementing the protocol interaction itself.
Used By
BOAST is used by projects such as:
Documentation
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Event ¶
type Event struct {
ID string `json:"id"`
Time time.Time `json:"time"`
TestID string `json:"testID"`
Receiver string `json:"receiver"`
RemoteAddr string `json:"remoteAddress,omitempty"`
Dump string `json:"dump,omitempty"`
QueryType string `json:"queryType,omitempty"`
}
Event represents an interaction event.
func NewDNSEvent ¶
NewDNSEvent allocates a new Event using NewEvent but with the difference of recording the passed DNS query type to keep more information for DNS queries.
type Storage ¶
type Storage interface {
SetTest(secret []byte) (id string, canary string, err error)
SearchTest(f func(k, v string) bool) (id string, canary string)
StoreEvent(evt Event) error
LoadEvents(id string) (evts []Event, loaded bool)
TotalTests() int
TotalEvents() int
StartExpire(err chan error)
}
Storage represents the BOAST's storage implementation. It's implemented by any type that provides these methods so it can be easily swapped by a DB or other kind of storage if needed.
Source Files
Directories