6

In my org am using the Twilio web application and cleared the security review using checkmark and when submitted I received an email to verify the Twilio using either chimera or zap.

If your app integrates with the https://api.twilio.com endpoint, please confirm and provide Web Application scan results (from either ZAP, Chimera, or Burp), along with API documentation (e.g. sample HTTP request and response (for all header values).

Before starting a scan, you must configure your site to prove that you are the owner. Chimera can only be used to scan web applications that you own or develop. To do this, click on "Download Token" to download your abuse prevention token. Follow the directions on that page to upload the token to your domain. If you are absolutely unable to upload the token to your server, please contact us using the address on the download token page. We will grant exceptions in very rare circumstances.

Am scanning web application (Twilio) how am I supposed to add token.

This is the chimera scan required credentials. Is that correct what I have entered

enter image description here

What is the step by step process to test the web-application detailed information will be helpful.

Improve this question
5
  • 1
    I'd also try and contact SF via a case to ask if you need to scan Twilio, since I think it is used internally by SF. But as an FYI, if you download ZAP, it doesn't need you to prove ownership - you can run it against any endpoint with the the caveat raised by dev-v1 re Twilio having an issue with you doing it...
    – BritishBoyinDC
    Dec 18, 2017 at 16:52
  • 1
    @BritishBoyinDC thanks, man :) that's what Am doing downloaded the ZAP. If you are familiar with ZAP then I have couple of questions- should I run the site in browser so that ZAP scans or directly should I enter the URL in ZAP to attack ??
    – SFDC
    Dec 19, 2017 at 4:46
  • 1
    I entered the URL in ZAP to attack but it's taking more than a day to scan
    – SFDC
    Dec 19, 2017 at 4:47
  • 1
    I've always used the 'URL to Attack' feature, but it's on fairly small site I have permission to run it against, and it runs immediately and doesn't take very long. Sounds like Twilio might be blocking your attempts?
    – BritishBoyinDC
    Dec 19, 2017 at 13:47
  • 1
    @BritishBoyinDC yeah I guess so it took more than 12 hrs and counting and number of URL's it's going on in lakhs- actually am using api.twilio.com as my endPoint, I should scan only the endpoint which am using right ?? No point in scanning the twilio.com its the website I will be scanning , when I scanned the api.twilio.com got the result pretty soon
    – SFDC
    Dec 20, 2017 at 9:58

1 Answer 1

Reset to default
5
+25

I would try and speak to SalesForce support about this, and possibly contact Twilio before doing any type of scanning. Most APIs will have a AUP or TOS that discourages users from using any type of vulnerability or code scanning against them.

Attempting to bypass or break any security mechanism on any of the Services or using the Services in any other manner that poses a security or service risk to Twilio or any of its users. https://www.twilio.com/legal/aup

Twilio's AUP is vague, so I would double check with them before running any automated tools against their site or API endpoint. In most cases, if you speak to the API provider, they can provide security and code details on request, that you can then in turn provide to SalesForce.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .