Where we have to upload Chimera abuse prevention token and what is Target URL in the New Scan page

Question

I am trying to scan my application in Chimera portal, I have logged into the portal and downloaded the abuse prevention token. Now I am not understanding where to upload it. In portal it says "You must upload the token to the root of the target site or its parent domain."

I am not understanding this point, can anyone explain with an example. Also in New Scan what will be the Target. (Say I have a managed package which I want to post on App Exchange, here what will be my Target).

Thanks in advance. I am new to this, please help.

Answer 1

Its important to understand that Chimera scan assumes you own the site or the app (Note its not your force.com app but an external app thats integrated with the force.com app)you are scanning .It implies you have built the external app (Not force.com app) and you have access to the root of the application .

Look at this answer to get a feel how this can be done for Node.js application .Same can be applied to Java or php apps .You need to keep the token file in the root folder .

The target there is your site url .Again not your force.com URL .Lets say your force.com app integrates with a website https://www.sample.com then the target will be https://www.sample.com.

Note that Chimera Report is needed for only external apps and in case you do not have access to the code base of the application you are integrating(lets say amazon or google API) then submit a ZAP report or if your client is ready to spend some $$$ you can go for BURP

Answer 2

Download the token from Chimera and store it as a .txt file. Then go to your application and upload it to the ROOT of the project.

Specifically for IntelliJ, drag the .txt file directly over the name of the overall app/project and place it there.

The root of the project means that this .txt file (URL that displays it) is available publicly on the internet, without authenticating or doing anything else.

It's quite easy to see if it was uploaded correctly: Once the file is uploaded and in place, make sure you can access the file by going to "YourExternalSite" .com/ChimeraToken.txt. If you can access the file, it is placed correctly. If not, the Chimera scan will not be able to either.

My specific use case was a Java app built in IntelliJ but I assume this will work on any app.