Integrating Invicti Standard with GoCD Automation Server

Automation helps make software development projects efficient. If changes made by Developers are used to trigger automatic scans, this saves the time required to manually configure and run scans, examine results, then assign and fix vulnerabilities. Those assigned to vulnerabilities can view scans as they are running. Meanwhile, development teams can continue to work on the areas to which they have been assigned, without having to switch tasks.

GoCD is continuous delivery software similar to Jenkins. GoCD enables you to build automation into your software development workflow (including testing, bug fixing, web security scanning and vulnerability fixing) by allowing you to trigger scans automatically when developers make changes to your web applications.

There are two steps in this procedure:

1. Adding the Invicti’s installation directory to PATH environment variable of the operating system.
2. Creating a Custom Command Task on GoCD.

Adding Invicti’s Installation Directory to the PATH Environment Variable

You need to add Invicti’s installation directory to your OS's PATH environment variable on every machine on which you use Invicti Standard.

How to Add Invicti’s Installation Directory to the PATH Environment Variable

1. From your PC's desktop, right-click This PC, then click Properties. The Properties window is displayed.

2. Click Advanced System Settings. The System Properties dialog is displayed with the Advanced tab open.
3. Click Environment Variables. The Environment Variables dialog is displayed.

4. From the System variables panel, click Path, then Edit. The Edit environment variable dialog is displayed.

5. Click New, then enter Invicti’s installation directory path (the default is 'C:\Program Files(x86)\Invicti')', and click OK.
6. Click OK to close all remaining dialogs.

Creating a Custom Command Task on GoCD

Once you create a Custom Command Task on the GoCD and the required fields are completed, when the task runs, it automatically scans with Invicti and saves the formatted reporting file, Detailed Scan Report.

How to Create a Custom Command Task on GoCD

1. Open GoCD.

2. From the Pipelines window, click the round settings button () next to the pipeline you want to edit. The Quick Edit window is displayed.

3. Click the Stages tab and click on the relevant stage. The Stage window is displayed.

4. Click the Jobs tab, and click on the relevant job. The Job window is displayed.

5. Click the Tasks tab, then click Custom Command. The Edit Custom Command task window is displayed.

6. In the Command field, enter:

invicti.exe

7. In the Arguments field, enter the following code:

/a
/url
http://php.testsparker.com/
/rt
"Detailed Scan Report"
/r
"C:\Program Files (x86)\Go Agent\pipelines\report_phptestsparkercom.html"

8. Click Save.