Job Script Syntax
Zirkul scripts are command executed by the Agent
Our Agent is a portable tool you can download from Zirkul and it's available for Windows, Linux and OSX, no installation is required for using it.
The easiest way to get used to the options available in Job scripts is to copy/paste the templates provided here, but if you want more advanced options, you can interact directly with the Agent in the command line interface, and it will help you in the process of building your custom scripts.
Quick Tutorial
Variables
Setting up variables to be used within the script:
var var_name = 'The value here'Then you can use the variable in several ways:
echo var_name
'The value here'
echo 'The value for the variable is "{{var_name}}"'
'The value for the variable is "The value here"'Targets
Targets are the assets managed in Zirkul, such as Web or Mobile Applications, REST APIs, IP addresses, etc. Every scan you will run requires to be assigned to a target by its numeric ID.
You can load a target in scripts and store the information in the object 'target' so you can later use any of the attributes associated to the asset.
target 123
[ ! ] Target loaded successfully: 150
echo target.id
123
echo 'The target name is: {{target.name}}'
The target name is: CICD test
# Print all target properties
echo target
Current target:
==================================================
id => 150
target_type => 'Web Application'
owner => <not set>
name => 'CICD test'
description => 'This is a description'
created_date => '2023-05-23 19:32:42'
created_by_api => False
created_by => '[email protected]'
last_modified_date => '2023-05-23 19:32:42'
last_modified_by_api => False
last_modified_by => '[email protected]'
Attributes:
cmdb_id => <not set>
Compliance:
rating => 'A+'
critical => 0
high => 0
medium => 0
low => 0
informational => 0Scans
Scans can be requested and updated directly from scripts.
Scan request:
The scan type may vary depending on your licensing but usually the options available are:
Dynamic Scan
Static Scan
Network Scan
SCA
IAST
RASP
Pentest
You can list the scan types available by typing:
Every scan type has its own attributes so make sure to provide the required values, the question mark can be used everywhere for getting help at any time if you're using the CLI tool.
The action "submit" send the request to Zirkul for creating a new scan, if the request is approved, the current scan is stored in the object "scan":
Update scans
If you want to update an existing scan, you can load it for modifying any of its attributes:
Web scan with Zirkul Scanner
The Agent has a built-in vulnerability scanner you can use for detecting issues in your web applications:
Plugins
The most powerful feature the Agent has is the ability to run scans with external tools, you can use plugins for well-known tools and orchestrate everything from Zirkul with this functionality.
For example, let's say you want to run a scan using Burp Suite Pro/Enterprise, nmap, OWASP ZAP, Wapiti, etc and get everything published in Zirkul, this is possible with the plugins available in the marketplace.
Example: OWASP ZAP
Publishing results
The results from all the security scans and plugins you run in the script are stored locally in the Agent's memory, you must explicitly publish the results for uploading the issues to Zirkul.
Last updated