Demo gauntlt

ssa.attack

@slow
Feature: Simple security scan against SSA
  Background:
    Given "nmap" is installed
    And "curl" is installed
    And "arachni" is installed
    And the following profile:
      | name           | value        |
      | hostname       | ssa.asteriskinfosec.com.au   |
      | host           | ssa.asteriskinfosec.com.au   |
      | url            | https://ssa.asteriskinfosec.com.au/   |
      | tcp_ping_ports | 22,25,80,443 |

  Scenario: Verify server is open on expected set of ports using the nmap-fast attack step
    When I launch a "nmap-fast" attack
    Then the output should match /81.tcp\s+open/
    And the output should match /443.tcp\s+open/

  Scenario: Verify that there are no unexpected ports open
    When I launch an "nmap" attack with:
      """
      nmap -F <hostname>
      """
    Then the output should not contain:
      """
      22/tcp
      25/tcp
      """

  Scenario: HTTP request should redirect to HTTPS
  When I launch a "curl" attack with:
    """
    curl --silent --output /dev/null --write-out "%{http_code}" <hostname>
    """
  Then it should pass with exactly:
    """
    301
    """

  Scenario: Look for XSS flaws on the front page
  When I launch an "arachni-simple_xss" attack
  Then the output should contain "0 issues were detected"