My AppSec Journal

Author: Pedric Kng

Purpose: This repository documents my learning for Application Security: Checkmarx Product Knowledge and DevSecOps

---

Customized CxQL for Checkmarx CxSAST

• Jackson/FasterXML: Command injection via deserialization
• CxxPath API Example
• Annotation attribute verification
• Example on adding input sanitizers
• Miscellaneous CxQL Exercises

---

Vulnerable Framework Example

• MyBatis Framework Example

---

DevOps Integration

• GitLab CI Shell Runner with CxSAST
• CxSAST SAST/OSA scans with Source Pulling
• AWS CodeCommit, CodeBuild, CodePipeline
• Jenkins Pipeline to push Jira ticket with SAST findings
• Azure DevOps and TFS Issue Tracking with Checkmarx
• TFVC with Azure DevOps Service via VSCode
• Parsing Results in CxXML Report

Miscellaneous

• Cloning machines on HyperV
• Checkmarx services script
• Create Active Directory Labs with Powershell
• Installing MS SQL 2017 on Ubuntu 18.04.3
• Common linux commands
• Jenkins Notes
• Power Query Example for CxSAST OData
• Docker
• Installing ngrok on Ubuntu