Rapid7 InsightAppSec

https://docs.rapid7.com/insightappsec/
Admin
InsightAppSec is Rapid7's Dynamic Application Security Testing (DAST) platform that helps teams...
Tokens:86,699
Snippets:1,207
Trust Score:10
Update:4 months ago
Show doc for...
Tokens:
Raw
### Freestyle Project Vulnerability Query Example

Source: https://docs.rapid7.com/insightappsec/jenkins-integration

Use a vulnerability query to fail the build based on specific vulnerability severities. This example shows how to fail the build for high severity vulnerabilities.

```text
vulnerability.severity='HIGH'
```

--------------------------------

### Example OpenAPI 3.0 JSON for LLM Scanning

Source: https://docs.rapid7.com/insightappsec/llm-scanning

This example shows how to tag an endpoint with 'chatbot' in an OpenAPI 3.0 JSON file to enable LLM scanning for that endpoint.

```json
{
  "paths": {
    "/ask-question": {
      "post": {
        "tags": ["chatbot"]
      }
    }
  }
}
```

--------------------------------

### Example JSON Request Body

Source: https://docs.rapid7.com/insightappsec/learn-about-apis

This is an example of a JSON request body used for creating or updating resources via an API. The specific fields will vary depending on the endpoint.

```json
{
  "name": "Name 1",
  "description": "This is a description.",
  "type": "Type 1"
}
```

--------------------------------

### Example Crawl Map Structure

Source: https://docs.rapid7.com/insightappsec/export-crawl-map

This JSON structure represents a segment of a web application's crawl map. It shows a POST request to a base URL and its subsequent GET requests with different query parameters.

```json
{
   "url": "webscantest.com/crosstraining/review.php",
   "method": "POST",
   "children": [
    {
     "node": "?product_id=1",
     "url": "webscantest.com/crosstraining/review.php?product_id=1",
     "method": "GET",
     "children": []
    },
    {
     "node": "?product_id=2",
     "url": "webscantest.com/crosstraining/review.php?product_id=2",
     "method": "GET",
     "children": []
    },
    {
     "node": "?product_id=3",
     "url": "webscantest.com/crosstraining/review.php?product_id=3",
     "method": "GET",
     "children": []
    },
    {
     "node": "?product_id=4",
     "url": "webscantest.com/crosstraining/review.php?product_id=4",
     "method": "GET",
     "children": []
    },
    {
     "node": "?product_id=5",
     "url": "webscantest.com/crosstraining/review.php?product_id=5",
     "method": "GET",
     "children": []
    },
    {
     "node": "?product_id=6",
     "url": "webscantest.com/crosstraining/review.php?product_id=6",
     "method": "GET",
     "children": []
    },
    {
     "node": "?product_id=7",
     "url": "webscantest.com/crosstraining/review.php?product_id=7",
     "method": "GET",
     "children": []
    },
    {
     "node": "?product_id=8",
     "url": "webscantest.com/crosstraining/review.php?product_id=8",
     "method": "GET",
     "children": []
    },
    {
     "node": "?product_id=9",
     "url": "webscantest.com/crosstraining/review.php?product_id=9",
     "method": "GET",
     "children": []
    }
   ]
  },
  {
   "node": "sample.php",
   "url": "webscantest.com/crosstraining/sample.php",
   "method": "GET",
   "children": []
  },
  {
   "node": "search.php",
   "url": "webscantest.com/crosstraining/search.php",
   "method": "GET",
   "children": [
    {
     "node": "?q=mightyseek",
     "url": "webscantest.com/crosstraining/search.php?q=mightyseek",
     "method": "GET",
     "children": []
    }
   ]
  },
  {
   "node": "sitereviews.php",
   "url": "webscantest.com/crosstraining/sitereviews.php",
   "method": "GET",
   "children": []
  }
 },
 {
  "node": "csrf",
  "url": "http://webscantest.com/csrf",
  "method": "GET",
  "children": [
   {
    "node": "aspnetSetCookie.php",
    "url": "webscantest.com/csrf/aspnetSetCookie.php",
    "method": "GET",
    "children": []
   },
   {
    "node": "aspnetsimulate.php",
    "url": "webscantest.com/csrf/aspnetsimulate.php",
    "method": "GET",
    "children": []
   },
   {
    "node": "csrfpost.php",
    "url": "webscantest.com/csrf/csrfpost.php",
    "method": "GET",
    "children": []
   },
   {
    "node": "redirect.php",
    "url": "webscantest.com/csrf/redirect.php",
    "method": "GET",
    "children": [
     {
      "node": "?msg=data",
      "url": "webscantest.com/csrf/redirect.php?msg=data",
      "method": "GET",
      "children": []
     }
    ]
   },
   {
    "node": "session.php",
    "url": "webscantest.com/csrf/session.php",
    "method": "GET",
    "children": [
     {
      "node": "?jsession=123456789",
      "url": "webscantest.com/csrf/session.php?jsession=123456789",
      "method": "GET",
      "children": []
     }
    ]
   },
   {
    "node": "token.php",
    "url": "webscantest.com/csrf/token.php",
    "method": "GET",
    "children": []
   },
   {
    "node": "token_autorized.php",
    "url": "webscantest.com/csrf/token_autorized.php",
    "method": "POST",
    "children": []
   }
  ]
 },
 {
  "node": "css",
  "url": "webscantest.com/css",
  "method": "GET",
  "children": [
   {
    "node": "style-buttons.css",
    "url": "webscantest.com/css/style-buttons.css",
    "method": "GET",
    "children": []
   },
   {
    "node": "style-forms.css",
    "url": "webscantest.com/css/style-forms.css",
    "method": "GET",
    "children": []
   },
   {
    "node": "style.css",
    "url": "webscantest.com/css/style.css",
    "method": "GET",
    "children": []
   }
  ]
 },
 {
  "node": "dashboard",
  "url": "http://webscantest.com/dashboard",
  "method": "GET",
  "children": []
 },
 {
  "node": "datastore",
  "url": "http://webscantest.com/datastore/",
  "method": "GET",
  "children": [
   {
    "node": "getimage_by_id.php",
    "url": "webscantest.com/datastore/getimage_by_id.php",
    "method": "GET",
    "children": [
     {
      "node": "?id=1",
      "url": "webscantest.com/datastore/getimage_by_id.php?id=1",
      "method": "GET",
      "children": []
     },
     {
      "node": "?id=2",
      "url": "webscantest.com/datastore/getimage_by_id.php?id=2",
      "method": "GET",
      "children": []
     },
     {
      "node": "?id=3",
      "url": "webscantest.com/datastore/getimage_by_id.php?id=3",
      "method": "GET",
      "children": []
     },
     {
      "node": "?id=4",
      "url": "webscantest.com/datastore/getimage_by_id.php?id=4",
      "method": "GET",
      "children": []
     },
     {
      "node": "?id=5",
      "url": "webscantest.com/datastore/getimage_by_id.php?id=5",
      "method": "GET",
      "children": []
     },
     {
      "node": "?id=6",
      "url": "webscantest.com/datastore/getimage_by_id.php?id=6",
      "method": "GET",
      "children": []
     },
     {
      "node": "?id=7",
      "url": "webscantest.com/datastore/getimage_by_id.php?id=7",
      "method": "GET",
      "children": []
     },
     {
      "node": "?id=8",
      "url": "webscantest.com/datastore/getimage_by_id.php?id=8",
      "method": "GET",
      "children": []
     }
    ]
   }
  ]
 }
```

--------------------------------

### Freestyle Project Build Advance Options

Source: https://docs.rapid7.com/insightappsec/jenkins-integration

Define how the Jenkins build advances based on the scan status. Options range from scan submission to completion with specific vulnerability criteria.

```text
Scan has been submitted
```

```text
Scan has been started
```

```text
Scan has been completed
```

```text
Vulnerability query has returned no vulnerabilities
```

--------------------------------

### Create an Application in InsightAppSec

Source: https://docs.rapid7.com/insightappsec/api-use-cases

Automate the creation of new application containers within InsightAppSec using a POST request. This is beneficial for onboarding multiple applications.

```python
import requests
import json

url = "https://us.api.insight.rapid7.com/ias/v1/apps"

payload = json.dumps({
  "name": "insert_app_name",
  "description": "insert_app_description"
})
headers = {
  'Accept': 'application/json',
  'Content-Type': 'application/json',
  'x-api-key': 'insert_api_key'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)
```

--------------------------------

### Get Vulnerabilities for an Application

Source: https://docs.rapid7.com/insightappsec/api-use-cases

Retrieve all vulnerabilities for a specific application in JSON format. This endpoint is useful for filtering and sorting vulnerability data for custom reporting.

```bash
GET https://[region].api.insight.rapid7.com/ias/v1/vulnerabilities
```

--------------------------------

### Freestyle Project Build Step Configuration

Source: https://docs.rapid7.com/insightappsec/jenkins-integration

Configure scan settings within a Freestyle project's build step. This includes selecting the data storage region, Insight API key, application, and scan configuration.

```text
Scan using Application Security (InsightAppSec)
```

--------------------------------

### Run a Scan with Scan Config ID

Source: https://docs.rapid7.com/insightappsec/api-identify-risk

Use this endpoint to initiate a new security scan. You must provide a valid scan configuration ID.

```bash
POST https://us.api.insight.rapid7.com/ias/v1/scans

Headers:
  X-Api-Key : {{Insight API Key}}
  Content-Type : application/json

Body:

{
  "scan_config": {
    "id": "{{Scan Config ID}}"
  }
}
```

--------------------------------

### Crawl Map Node Example

Source: https://docs.rapid7.com/insightappsec/export-crawl-map

Represents a single node within the crawl map, detailing a URL, its associated HTTP method, and any child nodes it may have.

```json
{
    "url": "webscantest.com/datastore/getimage_by_id.php?id=8",
    "method": "GET",
    "children": []
   }
```

```json
{
    "node": "?id=9",
    "url": "webscantest.com/datastore/getimage_by_id.php?id=9",
    "method": "GET",
    "children": []
   }
```

```json
{
   "node": "getimage_by_name.php",
   "url": "webscantest.com/datastore/getimage_by_name.php",
   "method": "GET",
   "children": [{
    "node": "?name=Rake",
    "url": "webscantest.com/datastore/getimage_by_name.php?name=Rake",
    "method": "GET",
    "children": []
   }]
  }
```

```json
{
   "node": "search_by_id.php",
   "url": "webscantest.com/datastore/search_by_id.php",
   "method": "GET",
   "children": []
  }
```

```json
{
   "node": "search_by_name.php",
   "url": "webscantest.com/datastore/search_by_name.php",
   "method": "GET",
   "children": []
  }
```

```json
{
   "node": "search_by_statement.php",
   "url": "webscantest.com/datastore/search_by_statement.php",
   "method": "GET",
   "children": [{
    "node": "?id=SELECT * from GOODS where name = 'rakes'",
    "url": "webscantest.com/datastore/search_by_statement.php?id=SELECT * from GOODS where name = 'rakes'",
    "method": "GET",
    "children": []
   }]
  }
```

```json
{
   "node": "search_by_statement_index.php",
   "url": "webscantest.com/datastore/search_by_statement_index.php",
   "method": "GET",
   "children": []
  }
```

```json
{
   "node": "search_double_by_name.php",
   "url": "webscantest.com/datastore/search_double_by_name.php",
   "method": "GET",
   "children": []
  }
```

```json
{
   "node": "search_get_by_id.php",
   "url": "webscantest.com/datastore/search_get_by_id.php",
   "method": "GET",
   "children": [{
    "node": "?id=1000",
    "url": "webscantest.com/datastore/search_get_by_id.php?id=1000",
    "method": "GET",
    "children": []
   }, {
    "node": "?id=3",
    "url": "webscantest.com/datastore/search_get_by_id.php?id=3",
    "method": "GET",
    "children": []
   }, {
    "node": "?id=4",
    "url": "webscantest.com/datastore/search_get_by_id.php?id=4",
    "method": "GET",
    "children": []
   }]
  }
```

```json
{
   "node": "search_get_by_name.php",
   "url": "webscantest.com/datastore/search_get_by_name.php",
   "method": "GET",
   "children": [{
    "node": "?name=Rake",
    "url": "webscantest.com/datastore/search_get_by_name.php?name=Rake",
    "method": "GET",
    "children": []
   }]
  }
```

```json
{
   "node": "search_single_by_name.php",
   "url": "webscantest.com/datastore/search_single_by_name.php",
   "method": "GET",
   "children": []
  }
```

```json
{
  "node": "gonowhere",
  "url": "http://webscantest.com/gonowhere",
  "method": "GET",
  "children": []
 }
```

```json
{
  "node": "hrs",
  "url": "http://webscantest.com/hrs/",
  "method": "GET",
  "children": [{
   "node": "redir.php",
   "url": "webscantest.com/hrs/redir.php",
   "method": "GET",
   "children": [{
    "node": "?q=mightyseek",
    "url": "webscantest.com/hrs/redir.php?q=mightyseek",
    "method": "GET",
    "children": []
   }]
  }, {
   "node": "redir_nv.php",
   "url": "webscantest.com/hrs/redir_nv.php",
   "method": "GET",
   "children": [{
    "node": "?q=mightyseek",
    "url": "webscantest.com/hrs/redir_nv.php?q=mightyseek",
    "method": "GET",
    "children": []
   }]
  }]
 }
```

```json
{
  "node": "icons",
  "url": "webscantest.com/icons",
  "method": "GET",
  "children": [{
   "node": "back.gif",
   "url": "webscantest.com/icons/back.gif",
   "method": "GET",
   "children": []
  }, {
   "node": "blank.gif",
   "url": "webscantest.com/icons/blank.gif",
   "method": "GET",
   "children": []
  }, {
   "node": "unknown.gif",
   "url": "webscantest.com/icons/unknown.gif",
   "method": "GET",
   "children": []
  }]
 }
```

```json
{
  "node": "images",
  "url": "webscantest.com/images",
  "method": "GET",
  "children": [{
   "node": "bouncingmike.jpg",
   "url": "webscantest.com/images/bouncingmike.jpg",
   "method": "GET",
   "children": [{
    "node": "?a=b",
    "url": "webscantest.com/images/bouncingmike.jpg?a=b",
    "method": "GET",
    "children": []
   }]
  }]
 }
```

```json
{
  "node": "index",
  "url": "http://webscantest.com/index",
  "method": "GET",
  "children": []
 }
```

```json
{
  "node": "index.php",
  "url": "http://webscantest.com/index.php",
  "method": "GET",
  "children": []
 }
```

```json
{
  "node": "infodb",
  "url": "webscantest.com/infodb",
  "method": "GET",
  "children": [{
   "node": "comment.php",
   "url": "webscantest.com/infodb/comment.php",
   "method": "GET",
   "children": []
  }, {
   "node": "index.php",
   "url": "webscantest.com/infodb/index.php",
   "method": "GET",
   "children": []
  }, {
   "node": "readme.php",
   "url": "webscantest.com/infodb/readme.php",
   "method": "GET",
   "children": []
  }, {
   "node": "readmetop.php",
   "url": "webscantest.com/infodb/readmetop.php",
   "method": "GET",
   "children": []
  }, {
   "node": "search_by_name.php",
   "url": "webscantest.com/infodb/search_by_name.php",
   "method": "POST",
   "children": []
  }]
 }
```

```json
{
  "node": "jsmenu",
  "url": "webscantest.com/jsmenu",
  "method": "GET",
  
```

--------------------------------

### Sorting API Results

Source: https://docs.rapid7.com/insightappsec/learn-about-apis

Use the 'sort' parameter to specify how results from an API call should be ordered. This example shows sorting scans by submit time in descending order.

```text
sort=scan.submit_time,DESC
```
Tokens:
Raw