Manual Application Scanning
This tutorial aims to run a security scan for your application manually in your source code through the CLI. Ensure that the Prerequisite is met, see section Scanning an Application for more details.
Adding a New Application
Login into the FortiDevSec portal and add a new application for your organization.
- Click on the New Application tab and enter the application name.
- Click Next and the App Setup information is displayed, download the fdevsec.yaml file from the application page.
You can optionally configure the risk ratings for your application. See section Adding a New Application for detailed procedure.
Integrating the fdevsec.yaml
Add the fdevsec.yaml file into the root folder of your source code. This tutorial uses only the mandatory parameters in the configuration file, you can add optional (advanced) parameters to make your scan more precise.
The application languages are automatically detected and FortiDevSec runs the appropriate scans.
See section Configuring the Scanner (fdevsec.yaml) for detailed procedure.
Running the Scan
Navigate to the root folder of the source code and run this command.
Use the SAST command for static source scan.
docker run --rm --mount type=bind,source="$PWD",target=/scan registry.fortidevsec.forticloud.com/fdevsec_sast:latest
Use the DAST command for dynamic application scan.
docker run --rm --mount type=bind,source="$PWD",target=/scan registry.fortidevsec.forticloud.com/fdevsec_dast:latest
See section Running the Security Scan for detailed procedure.
Viewing the Scan Result
The dashboard of the FortiDevSec portal lists the applications, click on your application to view and analyze comprehensive details of the detected vulnerabilities.
See section Viewing the Scan Result for more details.