Skip to content

Commit 84fd212

Browse files
CSPF-FounderCSPF-Founder
committed
first commit
0 parents  commit 84fd212

6 files changed

Lines changed: 680 additions & 0 deletions

File tree

‎.env.example‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# =============================================================================
2+
# API Scanner Configuration
3+
# Copy this file to .env and update the values before running docker compose up
4+
# =============================================================================
5+
6+
# --- MariaDB ---
7+
MARIADB_ROOT_PASSWORD=change_me_root_password
8+
MARIADB_USER=api_scanner
9+
MARIADB_PASSWORD=change_me_db_password
10+
MARIADB_DATABASE=api_db
11+
12+
# --- MongoDB ---
13+
MONGO_ROOT_USERNAME=root
14+
MONGO_ROOT_PASSWORD=change_me_mongo_root_password
15+
MONGO_DATABASE=apiscan_db
16+
MONGO_APP_USERNAME=apiscan_user
17+
MONGO_APP_PASSWORD=change_me_mongo_app_password
18+
19+
# --- API Scanner ---
20+
SERVER_ADDRESS=0.0.0.0:443
21+
USE_TLS=true
22+
CERT_PATH=/app/certs/cert.pem
23+
KEY_PATH=/app/certs/key.pem
24+
CSRF_KEY=change_me_csrf_key_32_chars_long!
25+
CSRF_NAME=csrf_token
26+
ALLOWED_INTERNAL_HOSTS=localhost,127.0.0.1,api-scanner
27+
TRUSTED_ORIGINS=https://localhost:4455
28+
29+
DBMS_TYPE=mysql
30+
# Note: 'mariadb' here refers to the docker-compose service name
31+
DATABASE_URI=api_scanner:change_me_db_password@tcp(mariadb:3306)/api_db?parseTime=True
32+
MIGRATIONS_PREFIX=/app/db/migrations
33+
34+
PRODUCT_TITLE=API Scanner
35+
COPYRIGHT_FOOTER_COMPANY=CySecurity Pte Ltd
36+
CONTACT_ADDRESS=support@localhost
37+
38+
# Note: 'mongodb' here refers to the docker-compose service name
39+
MONGO_DATABASE_URI=mongodb://apiscan_user:change_me_mongo_app_password@mongodb:27017/apiscan_db?authMechanism=SCRAM-SHA-256
40+
MONGO_DATABASE_NAME=apiscan_db
41+
42+
WORK_DIR=/app/data/work_dir
43+
TEMP_UPLOADS_DIR=/app/data/temp_uploads
44+
45+
LOG_LEVEL=info
46+
LOG_FILENAME=/app/logs/app.log
47+
48+
# Required by manager config but unused in Docker mode
49+
SCANNER_DOCKER=unused
50+
FUZZER_IMAGE=unused
51+
MAIN_DOMAIN=localhost
52+
53+
# Required by panel config but unused in community edition
54+
LICENSE_VALIDATION_API=http://localhost
55+
56+
# Note: 'zap' here refers to the docker-compose service name
57+
ZAP_HOST=zap
58+
ZAP_PORT=8080
59+
ZAP_API_KEY=change_me_zap_api_key
60+
61+
REMOTE_WORK_DIR=/app/data/work_dir/
62+
LOCAL_TEMP_DIR=/app/data/temp/
63+
64+
CATS_BIN_PATH=/app/bin/cats
65+
REPORTER_BIN_PATH=/app/bin/reporter
66+
SCANNER_CMD=/app/bin/scanner
67+
68+
# --- Timezone ---
69+
TZ=UTC

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
.env
2+
certs/

‎README.md‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
# API Scanner - Self-Hosted Deployment
2+
3+
API Scanner is an automated API security testing tool that scans REST and SOAP APIs for vulnerabilities using OpenAPI/Swagger specifications and WSDL files.
4+
5+
## Prerequisites
6+
7+
- Docker Engine 20.10+
8+
- Docker Compose v2
9+
- Python 3.6+ (for setup script)
10+
- 8 GB RAM minimum (16 GB recommended)
11+
- 20 GB disk space
12+
13+
## Quick Start
14+
15+
1. **Clone this repository**
16+
17+
```bash
18+
git clone https://github.com/cysecurity/api-scanner.git
19+
cd api-scanner
20+
```
21+
22+
2. **Run setup**
23+
24+
```bash
25+
python3 setup.py
26+
```
27+
28+
The script will:
29+
- Generate secure random passwords for all services
30+
- Auto-detect your timezone
31+
- Generate a self-signed TLS certificate (or use your own if already in `./certs/`)
32+
- Write the `.env` configuration file
33+
- Offer to start the Docker Compose stack
34+
35+
3. **Access the panel**
36+
37+
Open `https://localhost:4455` in your browser.
38+
39+
> If using a self-signed certificate, your browser will show a security warning — proceed to accept it.
40+
41+
## Manual Setup
42+
43+
If you prefer to configure manually instead of using the setup script:
44+
45+
1. Copy the example environment file:
46+
47+
```bash
48+
cp .env.example .env
49+
```
50+
51+
2. Edit `.env` and update:
52+
- All `change_me_*` passwords with strong random values
53+
- `CSRF_KEY` with a random 32+ character string
54+
- `ZAP_API_KEY` with a random string
55+
- `TRUSTED_ORIGINS` with your domain (e.g., `https://scanner.yourcompany.com`)
56+
- Ensure passwords in `DATABASE_URI` and `MONGO_DATABASE_URI` match the individual password variables
57+
58+
3. Start the stack:
59+
60+
```bash
61+
docker compose up -d
62+
```
63+
64+
## Architecture
65+
66+
| Service | Image | Description |
67+
|-----------------|------------------------------------|----------------------------------------------------|
68+
| **api-scanner** | `cysecurity/api-scanner:latest` | Web panel + scan engine in a single container |
69+
| **zap** | `ghcr.io/zaproxy/zaproxy:stable` | OWASP ZAP security scanner |
70+
| **mariadb** | `mariadb:10.11` | User management and session storage |
71+
| **mongodb** | `mongo:4.4` | Scan data, results, and reports |
72+
73+
## Configuration
74+
75+
All configuration is done through the `.env` file. See `.env.example` for all available options.
76+
77+
### Key Settings
78+
79+
| Variable | Description |
80+
|----------|-------------|
81+
| `MARIADB_PASSWORD` | MariaDB application user password |
82+
| `MONGO_APP_PASSWORD` | MongoDB application user password |
83+
| `CSRF_KEY` | CSRF protection key (32+ characters) |
84+
| `ZAP_API_KEY` | ZAP API authentication key |
85+
| `TRUSTED_ORIGINS` | Allowed HTTPS origins for the panel |
86+
| `USE_TLS` | Enable HTTPS (default: `true`) |
87+
| `TZ` | Timezone (default: `UTC`) |
88+
89+
## Data Persistence
90+
91+
All data is stored in Docker named volumes:
92+
93+
- `mariadb_data` — User accounts, roles, sessions
94+
- `mongodb_data` — Scan records, results, reports
95+
- `scanner_data` — Work files, uploaded specs, generated reports
96+
97+
## Updating
98+
99+
```bash
100+
docker compose pull
101+
docker compose up -d
102+
```
103+
104+
## Stopping
105+
106+
```bash
107+
docker compose down
108+
```
109+
110+
To remove all data (destructive):
111+
112+
```bash
113+
docker compose down -v
114+
```
115+
116+
## Troubleshooting
117+
118+
**Check logs:**
119+
120+
```bash
121+
docker compose logs api-scanner
122+
docker compose logs zap
123+
```
124+
125+
**Check service health:**
126+
127+
```bash
128+
docker compose ps
129+
```
130+
131+
**ZAP not starting:** Ensure at least 4 GB of free RAM. ZAP requires ~3 GB.
132+
133+
**Panel not accessible:** Verify TLS certificates are in `./certs/` and `TRUSTED_ORIGINS` matches your URL including the port (e.g., `https://localhost:4455`).
134+
135+
**Database connection errors:** Wait 30-60 seconds after first start for databases to initialize.
136+
137+
## License
138+
139+
Proprietary. See LICENSE file for details.

‎docker-compose.yml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
name: api-scanner
2+
3+
services:
4+
5+
mariadb:
6+
image: mariadb:10.11
7+
container_name: api-scanner-mariadb
8+
restart: always
9+
environment:
10+
MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
11+
MARIADB_USER: ${MARIADB_USER}
12+
MARIADB_PASSWORD: ${MARIADB_PASSWORD}
13+
MARIADB_DATABASE: ${MARIADB_DATABASE}
14+
TZ: ${TZ:-UTC}
15+
volumes:
16+
- mariadb_data:/var/lib/mysql
17+
healthcheck:
18+
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
19+
start_period: 15s
20+
interval: 10s
21+
timeout: 5s
22+
retries: 5
23+
networks:
24+
- api-scanner
25+
26+
mongodb:
27+
image: mongo:4.4
28+
container_name: api-scanner-mongodb
29+
restart: always
30+
environment:
31+
MONGO_INITDB_ROOT_USERNAME: ${MONGO_ROOT_USERNAME}
32+
MONGO_INITDB_ROOT_PASSWORD: ${MONGO_ROOT_PASSWORD}
33+
MONGO_INITDB_DATABASE: ${MONGO_DATABASE}
34+
MONGO_APP_USERNAME: ${MONGO_APP_USERNAME}
35+
MONGO_APP_PASSWORD: ${MONGO_APP_PASSWORD}
36+
TZ: ${TZ:-UTC}
37+
volumes:
38+
- mongodb_data:/data/db
39+
- ./mongo-init.sh:/docker-entrypoint-initdb.d/mongo-init.sh:ro
40+
healthcheck:
41+
test: ["CMD", "mongo", "--eval", "db.adminCommand('ping')"]
42+
start_period: 10s
43+
interval: 10s
44+
timeout: 5s
45+
retries: 3
46+
networks:
47+
- api-scanner
48+
49+
zap:
50+
image: ghcr.io/zaproxy/zaproxy:stable
51+
container_name: api-scanner-zap
52+
restart: always
53+
command: >
54+
zap.sh -daemon
55+
-host 0.0.0.0
56+
-port ${ZAP_PORT:-8080}
57+
-config api.addrs.addr.name=.*
58+
-config api.addrs.addr.regex=true
59+
-config api.key=${ZAP_API_KEY}
60+
mem_limit: 3g
61+
cpus: 1.5
62+
environment:
63+
JAVA_OPTS: "-Xmx2400m"
64+
TZ: ${TZ:-UTC}
65+
volumes:
66+
- scanner_data:/app/data:ro
67+
healthcheck:
68+
test: ["CMD", "curl", "-sf", "http://localhost:${ZAP_PORT:-8080}/JSON/core/view/version/?apikey=${ZAP_API_KEY}"]
69+
start_period: 30s
70+
interval: 15s
71+
timeout: 5s
72+
retries: 5
73+
networks:
74+
- api-scanner
75+
76+
api-scanner:
77+
image: cysecurity/api-scanner:latest
78+
container_name: api-scanner
79+
restart: always
80+
ports:
81+
- "4455:443"
82+
environment:
83+
# Panel
84+
SERVER_ADDRESS: ${SERVER_ADDRESS}
85+
USE_TLS: ${USE_TLS}
86+
CERT_PATH: ${CERT_PATH}
87+
KEY_PATH: ${KEY_PATH}
88+
CSRF_KEY: ${CSRF_KEY}
89+
CSRF_NAME: ${CSRF_NAME}
90+
ALLOWED_INTERNAL_HOSTS: ${ALLOWED_INTERNAL_HOSTS}
91+
TRUSTED_ORIGINS: ${TRUSTED_ORIGINS}
92+
DBMS_TYPE: ${DBMS_TYPE}
93+
DATABASE_URI: ${DATABASE_URI}
94+
MIGRATIONS_PREFIX: ${MIGRATIONS_PREFIX}
95+
WORK_DIR: ${WORK_DIR}
96+
TEMP_UPLOADS_DIR: ${TEMP_UPLOADS_DIR}
97+
PRODUCT_TITLE: ${PRODUCT_TITLE}
98+
COPYRIGHT_FOOTER_COMPANY: ${COPYRIGHT_FOOTER_COMPANY}
99+
CONTACT_ADDRESS: ${CONTACT_ADDRESS}
100+
LICENSE_VALIDATION_API: ${LICENSE_VALIDATION_API:-http://localhost}
101+
# Engine (manager)
102+
SCANNER_DOCKER: ${SCANNER_DOCKER:-unused}
103+
FUZZER_IMAGE: ${FUZZER_IMAGE:-unused}
104+
MAIN_DOMAIN: ${MAIN_DOMAIN:-localhost}
105+
SCANNER_CMD: ${SCANNER_CMD}
106+
# Engine (scanner)
107+
DB_NAME: ${MONGO_DATABASE_NAME}
108+
REMOTE_WORK_DIR: ${REMOTE_WORK_DIR}
109+
LOCAL_TEMP_DIR: ${LOCAL_TEMP_DIR}
110+
ZAP_HOST: ${ZAP_HOST}
111+
ZAP_PORT: ${ZAP_PORT}
112+
ZAP_API_KEY: ${ZAP_API_KEY}
113+
CATS_BIN_PATH: ${CATS_BIN_PATH}
114+
REPORTER_BIN_PATH: ${REPORTER_BIN_PATH}
115+
# Shared
116+
MONGO_DATABASE_URI: ${MONGO_DATABASE_URI}
117+
MONGO_DATABASE_NAME: ${MONGO_DATABASE_NAME}
118+
LOG_LEVEL: ${LOG_LEVEL}
119+
LOG_FILENAME: ${LOG_FILENAME}
120+
USE_DOTENV: "false"
121+
TZ: ${TZ:-UTC}
122+
volumes:
123+
- scanner_data:/app/data
124+
- ./certs:/app/certs:ro
125+
depends_on:
126+
mariadb:
127+
condition: service_healthy
128+
mongodb:
129+
condition: service_healthy
130+
zap:
131+
condition: service_healthy
132+
networks:
133+
- api-scanner
134+
135+
volumes:
136+
mariadb_data:
137+
mongodb_data:
138+
scanner_data:
139+
140+
networks:
141+
api-scanner:
142+
driver: bridge

‎mongo-init.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
set -e
3+
4+
mongo <<EOF
5+
db = db.getSiblingDB('${MONGO_INITDB_DATABASE}');
6+
7+
db.createUser({
8+
user: '${MONGO_APP_USERNAME}',
9+
pwd: '${MONGO_APP_PASSWORD}',
10+
roles: [
11+
{
12+
role: 'readWrite',
13+
db: '${MONGO_INITDB_DATABASE}',
14+
},
15+
],
16+
});
17+
EOF

0 commit comments

Comments
 (0)