run-pentest.sh

#!/usr/bin/env bash
set -euo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
cd "${REPO_ROOT}"

TARGET_URL="${TARGET_URL:-https://staging.gistpin.app}"
OUTPUT_DIR="${OUTPUT_DIR:-infrastructure/ci/reports/pentest}"
ZAP_CONFIG="${ZAP_CONFIG:-infrastructure/security/pentest/zap-config.yaml}"
SLACK_WEBHOOK="${SLACK_WEBHOOK:-}"
EXIT_CODE=0

log()  { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*"; }

mkdir -p "${OUTPUT_DIR}"
TIMESTAMP=$(date -u +%Y%m%d-%H%M%S)
REPORT_HTML="${OUTPUT_DIR}/pentest-report-${TIMESTAMP}.html"
REPORT_JSON="${OUTPUT_DIR}/pentest-report-${TIMESTAMP}.json"

check_prerequisites() {
  if ! command -v docker >/dev/null 2>&1; then
    log "ERROR: docker not installed."
    exit 1
  fi
  log "Docker available."
}

run_zap_scan() {
  log "Starting OWASP ZAP scan against ${TARGET_URL}..."

  docker run --rm \
    -v "$(pwd)/${ZAP_CONFIG}:/zap/config/zap-config.yaml:ro" \
    -v "$(pwd)/${OUTPUT_DIR}:/zap/reports:rw" \
    -e ZAP_ADMIN_PASSWORD="${ZAP_ADMIN_PASSWORD:-}" \
    -e ZAP_API_KEY="${ZAP_API_KEY:-}" \
    ghcr.io/zaproxy/zaproxy:stable \
    zap-full-scan.py \
    -t "${TARGET_URL}" \
    -c /zap/config/zap-config.yaml \
    -r pentest-report-${TIMESTAMP}.html \
    -w pentest-report-${TIMESTAMP}.json \
    -m 60 \
    -I \
    2>&1 | tee "${OUTPUT_DIR}/zap-output-${TIMESTAMP}.log"

  local exitcode=${PIPESTATUS[0]}
  if [[ ${exitcode} -ne 0 ]]; then
    log "ZAP scan completed with exit code ${exitcode}."
    EXIT_CODE=1
  else
    log "ZAP scan completed successfully."
  fi
}

analyze_results() {
  log "Analyzing pentest results..."
  if [[ ! -f "${REPORT_JSON}" ]]; then
    log "WARNING: JSON report not found at ${REPORT_JSON}"
    return
  fi

  local alerts_high alerts_medium alerts_low total
  alerts_high=$(python3 -c "
import json
with open('${REPORT_JSON}') as f:
    data = json.load(f)
high = len([a for a in data.get('site', []) for i in a.get('alerts', []) if i.get('riskcode') == '3'])
medium = len([a for a in data.get('site', []) for i in a.get('alerts', []) if i.get('riskcode') == '2'])
low = len([a for a in data.get('site', []) for i in a.get('alerts', []) if i.get('riskcode') == '1'])
print(f'{high},{medium},{low}')
" 2>/dev/null || echo "0,0,0")

  IFS=',' read -r high medium low <<< "${alerts_high}"
  total=$((high + medium + low))

  log "Pentest results: ${high} HIGH, ${medium} MEDIUM, ${low} LOW (${total} total)"

  if [[ "${high}" -gt 0 ]]; then
    EXIT_CODE=1
    log "CRITICAL: High severity vulnerabilities found!"
  fi
}

generate_summary() {
  jq -n \
    --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
    --arg target "${TARGET_URL}" \
    --arg report_html "${REPORT_HTML}" \
    --argjson exit_code "${EXIT_CODE}" \
    '{timestamp: $timestamp, target: $target, report: $report_html, exit_code: $exit_code}' \
    > "${OUTPUT_DIR}/pentest-summary-${TIMESTAMP}.json"
  log "Summary generated."
}

send_notifications() {
  local message="[GistPin] Pentest completed for ${TARGET_URL}"
  if [[ "${EXIT_CODE}" -ne 0 ]]; then
    message="${message} - HIGH RISK FINDINGS"
  else
    message="${message} - No high-risk findings"
  fi
  log "${message}"

  if [[ -n "${SLACK_WEBHOOK}" ]]; then
    curl -s -X POST "${SLACK_WEBHOOK}" \
      -H 'Content-type: application/json' \
      --data "{\"text\":\"${message}\"}" >/dev/null || true
  fi
}

main() {
  check_prerequisites
  run_zap_scan
  analyze_results
  generate_summary
  send_notifications

  if [[ "${EXIT_CODE}" -ne 0 ]]; then
    log "Pentest completed with findings requiring attention."
  else
    log "Pentest completed - no high-risk findings."
  fi

  exit "${EXIT_CODE}"
}

main "$@"