Gauntlt — Ruggedization Framework For Security Testing

Gauntlt is a ruggedization framework that is enables security testing that is usable by devs, ops and security.

Gauntlt provides hooks to a variety of security tools and puts them within reach of security, dev and ops teams to collaborate to build rugged software. It is built to facilitate testing and communication between groups and create actionable tests that can be hooked into your deploy and testing processes.

Features

• Gauntlt attacks are written in a easy-to-read language
• Easily hooks into your org’s testing tools and processes
• Security tool adapters come with gauntlt
• Uses unix standard error and standard out to pass status

Ruggedization Framework For Security Testing

Gauntlt includes attack adapters for the following tools:

• curl
• nmap
• sslyze
• sqlmap
• Garmr

You will need to install each tool yourself before you can use it with gauntlt. However, if you try to use a tool that is not installed or that gauntlt cannot find, you will get a helpful error message from gauntlt with information on how to install and/or configure the tool for use with gauntlt.

To use gauntlt, you will need one or more attack files. An attack file is a plain text file written with Gherkinsyntax and named with the .attack extension. For more info on the Gherkin syntax, have a look at Cucumber. A gauntlt attack file is almost the same as a cucumber feature file. The main difference is that gauntlt aims to provide the user with predefined steps geared towards security and durability testing so that you do not have to write your own step definitions, whereas cucumber is aimed at developers and stakeholders building features from end to end. Gauntlt and cucumber can and do work together harmoniously.

[adsense size='1']

What an attack file looks like

# my.attack
Feature: Description for all scenarios in this file
  Scenario: Description of this scenario
    Given ...
    When ...
    Then ...

  Scenario: ...
    Given ...
    When ...
    Then ...

You can have as many Scenario entries as you like, but it is good practice to keep the number low and to ensure that the scenarios in an attack file are all related. You can create as many attack files as you like and organize them in folders and sub-folders as well.

There are a large number of step definitions available, but you can do a lot with just these 3:

Feature: Attack with kindness

  Scenario: Ensure I am not mean
    # verify a given attack adapter is installed
    # HIGHLY RECOMMENDED to catch installation/configuration problems
    Given "kindness" is installed

    # Execute the attack
    When I launch a "kindness" attack with:
      """
      whoami  # EXACT commands to be executed on the command line
      """

    # Check exit status and STDOUT
    Then it should pass with:
      """
      very_kind
      """

Pre-req’s

We recommend running gauntlt using ruby 1.9.3 or ruby 2.0.0 and installing it from rubygemsgem install gauntlt or adding it to your Gemfile and use bundler.

If you are using Kali Linux 2.0, Debian Jessie, Ubuntu 14.04, or Ubuntu 15.10, you can run the following:

git clone https://github.com/gauntlt/gauntlt
cd gauntlt
source ./install_gauntlt_deps.sh
bash ./ready_to_rumble.sh
gauntlt

This script will install Ruby RVM, all the required system dependencies and tools, and update your .bashrc with the necessary environmental variables. You can install this for another user by exporting $HOME_FOLDER and $USER_NAME variables before running install_gauntlt_deps.sh

[adsense size='1']

To install Gauntlt from source, you will need ruby version 2.1.0 or higher, but you can run gauntlt against applications built with any language or platform.

1. Install the gem

   $ gem install gauntlt

2. Create an attack file and put it anywhere you like. (There is a more relevant example on gauntlt.org)

   # simplest.attack
   Feature: simplest attack possible
     Scenario:
       When I launch a "generic" attack with:
         """
         ls -a
         """
       Then the output should contain:
         """
         .
         """

3. Run gauntlt to launch the attack defined above

   $ gauntlt
   # equivalent to gauntlt ./**/*.attack
   # by default, gauntlt will search in the current folder
   # and its subfolders for files with the .attack extension
   
   # you can also specify one or more paths yourself:
   $ gauntlt my_attacks/*.attack some_other.file

   For more attacks, refer to the examples.

4. Other commands

   # list defined attacks
   $ gauntlt --list
   
   # get help
   $ gauntlt --help

Source && Download

https://github.com/gauntlt/gauntlt