valllabh

TotalAppSec Auto Ignore Findings by Response Payload

A Python script that uses the TotalAppSec V4 Finding API to automatically ignore false positive findings based on string matching in HTTP response payloads.

Use Case

Some QIDs (e.g., 150263 Insecure Transport) produce false positives when intermediary devices like AWS ALB or CloudFlare respond instead of the actual web server. This script identifies those findings by inspecting the HTTP response payload and ignores them as FALSE_POSITIVE.

How It Works

valllabh

{
  "cs:v3": {
    "base": "https://gateway.p33.eng.in03.qualys.com/",
    "spec_files": ["https://gateway.p33.eng.in03.qualys.com/apidocs/yaml/csapi-swagger-v1.3.yaml"],
     "profiles": {
      "default": {
        "headers": {
          "accept": "application/json"
        }
      }

valllabh

openapi: 3.0.1
info:
  title: Container Security API
  description: |
    # Authentication
    You must authenticate to the Qualys Cloud Platform using Qualys account credentials (user name and password) and get the JSON Web Token (JWT) before you can start using the Container Security APIs.
    Use the Qualys Authentication API to get the JWT.

    **Example Authentication Curl Request**:

valllabh

package com.example;

import java.io.IOException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.Authentication;

valllabh

<?php

function HumanSize($Bytes) {
  $Type = array("", "kilo", "mega", "giga", "tera", "peta", "exa", "zetta", "yotta");
  $Index = 0;
  while($Bytes >= 1024) {
    $Bytes /= 1024;
    $Index++;
  }
  return("".$Bytes." ".$Type[$Index]."bytes");

valllabh

var timeago = {
	get : function(from, to){

		(!to) && (to = new Date());

		from = from.getTime();
		to = to.getTime();
	 
		if (typeof from !== 'number' || typeof to !== 'number') {
			return;

valllabh

inotifywait . -r -m -e close_write | while read x op f; do
	if [[ "$f" == *".less" ]]; then
		css=$x${f//.less/.css};
		lessc $x$f > $css && echo "Compiled $x$f >> $css @ `date`";
	fi
done

valllabh

function pr(){
	$args = func_get_args();
	foreach($args as $var){
		print '<pre>';
			print_r($var);
		print '</pre>';
	}
}

valllabh

function text_url_to_clickable_url($content = NULL){
	if(!$content){
		return FALSE;
	}

	//The Regular Expression filter
	$reg_exUrl = '/((?:(?:f|ht){1}(?:tp|tps):\/\/)[\w\d\S]+)/';

	$matches = array();
	preg_match_all($reg_exUrl, $content, $matches, PREG_SET_ORDER);