Subscribe to our Blog

Get the Latest Application Security News and Content

Integrating NexPloit scanning into Azure DevOps

Why should security testing be implemented in the DevOps process?

DevOps focuses on speedy completion of the development processes for faster delivery of products and services at a higher quality. Not considering security in the development process can leave your application vulnerable to attacks. This is no different than releasing buddy software. For example, stored data could be unencrypted, the code may be vulnerable to buffer overflow, or there might be a data leakage. Vulnerabilities and flaws in a product or a service can be endless if its security has not been considered.

In order to ensure that security is an integral part of DevOps, security testing should be performed on an ongoing basis to keep up with the continuous development. Performing penetration tests manually is not only tedious but it also completely negates the benefits achieved from the DevOps process as it slows the entire development process down. Moreover, due to the huge shortage of security people globally the delays are typically even longer resulting in both vulnerable code and wasted developer time to go back and fix vulnerabilities months after they were introduced. 

Automated AI-driven application security tools like NexPloit solve this problem.

  1. In addition to solving the issues above, NexPloit provides 0 false-positive results and gives detailed instructions on how to fix the security issues identified
  2. By detecting and fixing security issues during the development phases, the speed of delivery is increased resulting in significant cost reduction. Instead of having a pen testing team you can use NexPloit to reduce costs and ensure better results
  3. By using NexPloit companies can keep up with the frantic pace of innovation of cybercrime. NexPloit enables you to effectively manage security audits, monitor, provide notifications and even discover 0-day vulnerabilities

NOTE: With the huge shortage in security personnel companies are challenged to hire security experts as well as DevOps making NexPloit an ideal solution for overcoming this challenge.

NexPloit is an AI-Powered Application Security Testing (AIAST) solution, automating the critical thinking process run by a cyber-security specialist to scan any target and find real vulnerabilities, including logical-flow problems, with no false positives.

The NexPloit extension allows you to harness NexPloit’s power within your CI. The extension can be downloaded here.

Setting up NexPloit within the CI/CD Pipeline

Using a pre-recorded HAR file

Upload the file using a simple curl command:

$ curl -X POST “https://nexploit.app/api/v1/files?discard=true” \
-H “Content-Type: multipart/form-data” \
-H “Authorization: Api-Key yufn0f6.yourapikeykuj069zopv0b1i” \
-F “har=@/path/to/the/file.har”
{“ids”:[“6xkFraa5ecfmHhxTEnabZg”]}

This if will then be used for the File ID field. When the setup is complete, the new scan will start automatically and be visible in your NexPloit account.

NOTE: An active subscription for NexPloit is needed for usage of this extension.

Get an API Key

In NexPloit Dashboard navigate to the Organization tab and scroll to the Manage your application API keys section.

Press Create new API key button and enter any suitable name (e.g. Azure key)

NOTE: Make sure to backup the API key. It cannot be restored.

What is Azure DevOps?

Azure Pipelines is a fully-featured continuous integration and continuous delivery service. 

Languages which are supported with Azure Pipeline are:

Python, Java, JavaScript, PHP, Ruby, C#, C++, and Go which means that any client should be able to use our integration service. 

Since Azure supports scripting in all the languages mentioned above, it is not a problem to add NexPloit to the deployment code. Every client that uses NexPloit can ensure a better experience to their end-users and be aware of all security issues as soon as they are discovered. With NexPloit and Azure, you can prevent your applications from going into production with security issues.

Why integrate NexPloit into your Azure DevOps?

Every day more and more companies fall victim to 0-day exploits and massive data leaks costing millions and millions of dollars. The old method of employing a security team to scan for vulnerabilities is both very costly and has failed companies due to the significant shortage in security personnel and the significant delays in identifying vulnerabilities.

Integrating NeXPloit into your Azure DevOps process solves this problem by allowing a secure and automated approach for adding application security testing into the process.