4

I've been looking into the Chimera Security Scanner and it mentions that you have to provide test credentials and the URL of your service and, Chimera will handle the rest.

The only issue that we currently have with this is that, our current set of web methods / API do not require authentication. Sending a request to the methods, do not require a traditional login and password.

EX: Our Salesforce app performs SOAP requests to our web method from inside APEX code.

In order to test our set of web methods / API with Chimera, is it possible with our current setup? Or do we have to update our API to required a username / password, in order to proceed with Chimera?

Thanks,

Improve this question

1 Answer 1

Reset to default
6

If you don't provide credentials, we'll simply scan the site unauthenticated. If credentials are provided, we'll do our best to automatically login (this feature isn't perfect yet, but we're working on it constantly!).

Hope this (and Chimera) helps! Just as a heads up, automated web scanners like what Chimera use aren't always that useful on API-only systems. They rely on having more web surface to scan. That said, you may still get some useful data out of it, and there's nothing to lose.

If you have any questions, feel free to let me know.

-- Tim, Salesforce Product Security

Improve this answer
1
  • 1
    hello @tim couple of questions. I need to scan an external application which I don't own but chimera is asking to provide credentials with prevention abuse token added to root server 2). So I moved to ZAP which scans the whole application it takes more than 2-3 hours to scan, is that usual or am I doing it wrong ?? I mean I entered the URL in the textbox which asks URL to attack or should I launch browser and enter the site ??
    – User
    Dec 18, 2017 at 11:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .