Xygeni

https://docs.xygeni.io
Admin
Xygeni is an Application Security Posture Management (ASPM) platform that provides risk assessment,...
Tokens:312,015
Snippets:2,219
Trust Score:9.2
Update:1 week ago
Show doc for...
Tokens:
Raw
### Run interactive setup wizard

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

Starts the guided configuration wizard. It asks about the target and writes a profile YAML, a ready-to-run command line, or both. Only relevant questions are asked, and every question has a default, so pressing Enter throughout still produces a working configuration.

```bash
xy-dast interactive
```

--------------------------------

### Install xy-dast on Windows with PowerShell

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

One-command installer for Windows. The first command installs the wrapper; the second shows how to download and run the script to pass parameters. Installs into `$HOME\.local\bin` unless `-InstallDir` says otherwise.

```powershell
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 | iex

# `iex` cannot pass parameters. To use any, download the script and run the file:
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 -OutFile get-dast.ps1
.\get-dast.ps1 -InstallDir C:\Tools\bin -AddToPath
```

--------------------------------

### Install and run DAST on Windows

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Downloads and installs the DAST scanner via PowerShell, then runs the interactive setup. The installer verifies the signature and pins the wrapper to the verified digest.

```powershell
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 | iex
xy-dast interactive
```

--------------------------------

### Install and run DAST on Linux/macOS

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Downloads and installs the DAST scanner via curl, then runs the interactive setup. The installer verifies the signature and pins the wrapper to the verified digest.

```bash
curl -fsSL https://get.xygeni.io/latest/dast/get-dast.sh | sh   # install, signature-verified
xy-dast interactive                                            # answer a few questions
```

--------------------------------

### Install xy-dast wrapper (Linux/macOS)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Runs the Docker image's install subcommand to drop the wrapper and sidecar into ~/.local/bin.

```bash
docker run --rm -v ~/.local/bin:/mnt/install xygeni/xy-dast install
```

--------------------------------

### Run get-xygeni.sh installer (macOS/Linux)

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-installation

Executes the bootstrap script. By default it installs to ~/.xygeni, or you can pass a custom directory as an argument.

```bash
# Default installs to ~/.xygeni, or pass a custom directory
sh get-xygeni.sh [install_dir]
```

--------------------------------

### Install xy-dast on Linux/macOS with curl

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

One-command installer for Linux/macOS. The first command installs the wrapper; the second shows how to pass options through the pipe using `-s --`. Installs into the first writable of `$HOME/.local/bin` or a `$HOME/bin` already on your PATH, falling back to `$HOME/.local/bin`.

```bash
curl -fsSL https://get.xygeni.io/latest/dast/get-dast.sh | sh

# To pass options through the pipe, separate them with `-s --`:
curl -fsSL https://get.xygeni.io/latest/dast/get-dast.sh | sh -s -- -d /usr/local/bin --add-to-path
```

--------------------------------

### Create install directory and add to PATH (Linux)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Creates ~/.local/bin and ensures it is on PATH for the current and future shells. The directory must exist before the install command to avoid permission issues.

```bash
# 1. Create the directory (idempotent)
mkdir -p ~/.local/bin

# 2. Make sure it is on PATH for the current shell
case ":$PATH:" in *":$HOME/.local/bin:"*) ;; *) export PATH="$HOME/.local/bin:$PATH" ;; esac

# 3. Persist for future shells (only needed once per shell rc)
grep -q '\.local/bin' ~/.bashrc 2>/dev/null \
  || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
# zsh users: replace ~/.bashrc with ~/.zshrc
```

--------------------------------

### Install SALT CLI (Linux/macOS)

Source: https://docs.xygeni.io/xygeni-products/build-security

Downloads and installs the SALT command-line tool. The commands work under Linux/macOS. Replace PATH_TO_DIR with the directory where the tool will be uncompressed.

```bash
# download zipfile
curl -sLO https://get.xygeni.io/latest/salt/salt.zip
# unzip in current directory
unzip salt.zip -d PATH_TO_DIR
# add alias
alias salt="PATH_TO_DIR/xygeni_salt/salt"
```

--------------------------------

### BitBucket Pipelines: Install and run Xygeni scanner using installation script

Source: https://docs.xygeni.io/xygeni-administration/platform-administration/integrations/integrate-scanner-cli-into-ci-cd-systems/bitbucket-integration

Use this pipeline configuration to install the scanner via the bootstrap script and run a scan. The script downloads the scanner, verifies its SHA-256 checksum, and unpacks it into $HOME/.xygeni. Requires Java 17 or higher and the XYGENI_TOKEN environment variable.

```yaml
pipelines:
  default:
    - parallel:
      - step:
          name: 'Install & run Xygeni scanner'
          script:
            - >
              curl -sSfL -o get-xygeni.sh https://get.xygeni.io/latest/scanner/get-xygeni.sh &&
              curl -sSfL -o get-xygeni.sh.sha256 https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/get-xygeni.sh.sha256 &&
              echo "$(cat get-xygeni.sh.sha256)  get-xygeni.sh" | sha256sum -c - &&
              bash get-xygeni.sh
            - $HOME/.xygeni/xygeni scan -n $PROJECT_NAME --dir $PROJECT_HOME
```

--------------------------------

### Verify installer checksum on Windows

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

Downloads the installer script and its SHA256 checksum from the GitHub repository, verifies the checksum, then runs the installer. The digest lives in a different place from the script it vouches for, so an attacker would have to compromise both `get.xygeni.io` and the GitHub repository to pass this check.

```powershell
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 -OutFile get-dast.ps1
$h = (iwr -useb https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/get-dast.ps1.sha256).Content.Trim()
(Get-FileHash .\get-dast.ps1 -Algorithm SHA256).Hash -eq $h.ToUpper()
.\get-dast.ps1
```

--------------------------------

### Install xy-dast wrapper (Windows PowerShell)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Runs the Docker image's install subcommand with --powershell to produce the signed .ps1 wrapper.

```powershell
docker run --rm -v "${HOME}\.local\bin:/mnt/install" xygeni/xy-dast install --powershell
```

--------------------------------

### Verify installer checksum on Linux/macOS

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

Downloads the installer script and its SHA256 checksum from the GitHub repository, verifies the checksum, then runs the installer. The digest lives in a different place from the script it vouches for, so an attacker would have to compromise both `get.xygeni.io` and the GitHub repository to pass this check.

```bash
curl -fsSLO https://get.xygeni.io/latest/dast/get-dast.sh
h=$(curl -fsS https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/get-dast.sh.sha256)
echo "$h get-dast.sh" | sha256sum -c
sh ./get-dast.sh
```

--------------------------------

### .env file for Xygeni scanner quickstart

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-docker-image

Provides environment variables for the docker-compose quickstart: PATH_TO_SCAN and PROJECT_NAME. Edit these values to customize volume paths or project name.

```plaintext
PATH_TO_SCAN=...
PROJECT_NAME=...
```

--------------------------------

### pipgrip command to get dependency tree

Source: https://docs.xygeni.io/xygeni-products/open-source-security-oss/dependency-scanner/dependency-analyzers

Command executed by the Pip analyzer to get the dependency tree. Requires pipgrip and pip to be installed.

```bash
pipgrip --tree --json
```

--------------------------------

### Retrieve secret with AWS SDK for Go

Source: https://docs.xygeni.io/xygeni-products/secrets-security/secret-leaks-handling/how-to-prevent-hard-coded-secrets

Uses the AWS SDK for Go v2 to get a secret value from AWS Secrets Manager. Requires the github.com/aws/aws-sdk-go-v2 packages. The example shows loading config and calling GetSecretValue.

```go
import (
	"context"
	"encoding/json"
	"fmt"
	"log"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
)

cfg, err := config.LoadDefaultConfig(context.TODO(), config.WithRegion(your_region))
if err != nil { ... }
client := secretsmanager.NewFromConfig(cfg)
input := &secretsmanager.GetSecretValueInput{ SecretId: aws.String(secretName), }
result, err := svc.GetSecretValue(input)
if err != nil { ... }
secret := *result.SecretString
```

--------------------------------

### Combining tech base and intensity examples

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner/dast-scanner-configuration

Three example commands showing different combinations of tech base and intensity, including a deep API scan, a quick SPA smoke test, and a production-safe passive scan.

```bash
xy-dast scan -u https://api.example.com --profile openapi --intensity deep    # deep API scan (CVE + deep crawl on)
xy-dast scan -u https://app.example.com --profile spa      --intensity quick   # fast SPA smoke test
xy-dast scan -u https://prod.example.com --profile traditional --intensity passive  # production-safe: no active payloads
```

--------------------------------

### Retrieve secret with .NET AWS SDK (C#)

Source: https://docs.xygeni.io/xygeni-products/secrets-security/secret-leaks-handling/how-to-prevent-hard-coded-secrets

Uses the .NET AWS SDK with the caching extension to get a secret value from AWS Secrets Manager. The example shows a helper method that retrieves the secret using the AWSCURRENT version stage.

```csharp
using Amazon.SecretsManager.Extensions.Caching;

var client = new AmazonSecretsManagerClient();
var response = await GetSecretAsync(client, "SECRET");
if (response is not null && response.SecretString is not null)
{
    string secret = response.SecretString;
}
...

private static async Task<GetSecretValueResponse>
  GetSecretAsync( IAmazonSecretsManager client, string secretName )
{
    var request = new GetSecretValueRequest()
    {
        SecretId = secretName,
        VersionStage = "AWSCURRENT", // the default
    };

    return await client.GetSecretValueAsync(request);
}
```

--------------------------------

### xygeni quality duplication examples

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-scanner-reference

Three example commands showing how to use the duplication options: one with upload and report, one with clone types and minimum tokens, and one as a CI/CD gate.

```bash
# Quality scan with upload, keeping the duplication report locally
xygeni quality -d . -n MyProject --upload --duplication-report /tmp/duplication

# Exact copies only, at least 300 tokens
xygeni quality -d . --duplication-clone-types identical --duplication-min-tokens 300

# Use duplication as a CI/CD gate
xygeni quality -d . --fail-on-duplication-ratio 15
```

--------------------------------

### Run the Xygeni installer script

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-installation

Runs the PowerShell installer script. By default installs to $Home\.xygeni, or you can pass -Dir to specify a custom directory.

```powershell
.\get-xygeni.ps1 [-Dir C:\path\to\install]
```

--------------------------------

### Attestation drafting workflow with salt attestation commands

Source: https://docs.xygeni.io/xygeni-products/build-security/salt-command-line-reference

Complete attestation drafting workflow: init creates the draft with git and environment attestors, add adds materials/products/predicates, run captures a build step (go install), and commit signs and publishes. Use CI/CD variables for a unique --pipeline value, e.g. $GITHUB_WORKFLOW_REF/$GITHUB_RUN_ID in GitHub Actions.

```bash
# Initialize attestation
salt -nb attestation init -p $PIPELINE -d $REPO_DIR \
     --attestor git --attestor environment

# Add material (src directory) and products
# (command-line executable tool built, and OCI image)
salt -nb attestation add -p $PIPELINE -d $REPO_DIR \
     --type material --file src
     --type product --file path/to/cli_tool  \
     --type product --image myorg/my_image:my_tag

# Add an attestation predicate,
# for example issues from your favorite Xygeni scan
# in the in-toto Vulnerabilities predicate format:
salt -nb attestatation add -p $PIPELINE -d $REPO_DIR \
     -n xygeni-scan -t predicate -f path/to/xygeni_scan.json \
     --predicate-type https://in-toto.io/attestation/vulns

# Capture a build step to be included in the attestation
# In the example the current Go package is built and installed:
salt -nb attestation run -p $PIPELINE -d $REPO_DIR \
     --step compile -- \
     go install

# ... more attestation add commands may follow ...

salt -nb attestation commit -p $PIPELINE -d $REPO_DIR \
     -k env:MY_KEY -kpass env:MY_KEY_PASS -pk env:MY_PUB \
     -o attestation.json --output-unsigned
```

--------------------------------

### Install pre-commit hooks: pre-commit install

Source: https://docs.xygeni.io/platform-administration/integrations/git-hooks-with-xygeni

Installs the git hook scripts after configuring .pre-commit-config.yaml. Comments show how to test the configuration with pre-commit try-repo or pre-commit run.

```bash
# You may test the hook configuration with
#   pre-commit try-repo or pre-commit run
pre-commit install

```

--------------------------------

### Examples of setting configuration options via command line

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-configuration-options

Provides multiple examples of using -cop/--conf-option to set various configuration properties, including disabling commit resolution, setting parallel mode, disabling timeout, and using complex values with report formatting and environment variables.

```bash
# Disable commit resolution
xygeni -cop 'commitResolution:never' scan ...
# Set parallel mode with two threads
xygeni -cop 'mode:parallel' -cop 'parallelism:2' secrets ...
# Disable timeout
xygeni -cop 'timeout:0' secrets ...

# More complex cases (using long or short option names):
xygeni --config-option "report[format=text]/sort: exposure" \
  --config-option "report[format=text]/borders: none" \
  --config-option "parallelism: min(availableProcessors - 1, 4)" \
  scan ...

# Imagine that the user has this environment var instead of the expected JENKINS_URL
xygeni -cop "cicd[kind=jenkins]/url: ${MY_JENKINS_URL}" misconf ...
```

--------------------------------

### Install unzip (Linux)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-cli

Installs the unzip command if it is not available on your system.

```bash
sudo apt install unzip
```

--------------------------------

### salt attestation --help

Source: https://docs.xygeni.io/xygeni-products/build-security/salt-command-line-reference

Shows the help output for the `salt attestation` command, listing its options and subcommands. The command creates software attestations following the in-toto Attestations Framework, either incrementally (init/add/run/commit/reset) or in one shot with `provenance`/`slsa`. The `--never-fail` option defaults to false, and the config file defaults to `$HOME/.salt/salt.yaml` or `$SALT_HOME/conf/salt.yaml`.

```bash
$ salt attestation --help

Usage: salt attestation [-hV] [--never-fail] [--config=<config>] -p=<pipeline>
                        [@<filename>...] CMD

Create software attestation: incrementally using init / add / run / commit|reset, or SLSA
build provenance in a single shot.

      [@<filename>...]    One or more argument files containing options.
  -p, --pipeline=<pipeline>
                          name of the pipeline/workflow being run.
      --never-fail        Always return 0, even with errors, to keep the pipeline
                            running. Default: false
  -h, --help              Show this help message and exit.
  -V, --version           Print version information and exit.
      --config=<config>   config file (default $HOME/.salt/salt.yaml or
                            $SALT_HOME/conf/salt.yaml)

Commands:
  init              start attestation drafting process
  run               run a command and add attestation for the command execution
  add               add element (material, subject, product or statement) to draft
                      attestation
  status            show the current draft attestation
  commit            complete and store the attestation in draft
  reset             reset attestation in draft
  provenance, slsa  generate and sign SLSA provenance
```

--------------------------------

### Npm: Generate yarn.lock with yarn install

Source: https://docs.xygeni.io/xygeni-products/open-source-security-oss/dependency-scanner/dependency-analyzers

When no lock file is found, the analyzer generates a yarn.lock file in a temporary directory by running this command. Requires yarn; if not installed, the analyzer tries to install it.

```bash
yarn install --ignore-scripts --modules-folder ${TEMPDIR}/node_modules
```

--------------------------------

### xygeni -cop examples for configuration options

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-scanner-reference

Examples of using the -cop/--conf-option global option to set configuration properties. Includes disabling commit resolution, setting parallel mode, disabling timeout, complex cases with report formatting, and using environment variables.

```bash
# Disable commit resolution
xygeni -cop 'commitResolution:never' scan ...
# Set parallel mode with two threads
xygeni -cop 'mode:parallel' -cop 'parallelism:2' secrets ...
# Disable timeout
xygeni -cop 'timeout:0' secrets ...

# More complex cases (using long or short option names):
xygeni --config-option "report[format=text]/sort: exposure" \
  --config-option "report[format=text]/borders: none" \
  --config-option "parallelism: min(availableProcessors - 1, 4)" \
  scan ...
  
# Imagine that the user has this environment var instead of the expected JENKINS_URL
xygeni -cop "cicd[kind=jenkins]/url: ${MY_JENKINS_URL}" misconf ...
```

--------------------------------

### Install salt command autocompletion

Source: https://docs.xygeni.io/xygeni-products/build-security/salt-how-to...

Installs command-line completion for the salt command (Bash or ZSH shells).

```bash
source <(salt generate-completion)
```

--------------------------------

### Full project configuration example

Source: https://docs.xygeni.io/xygeni-products/api-security/api-security-scanner/api-security-scanner-configuration

A complete project configuration that disables autodiscovery, pins frameworks, tightens sensitive-data detectors, suppresses a known-public field, and disables rate_limit_absence. Run with the provided CLI command.

```yaml
autodiscovery:
  enabled: no

frameworks:
  enabled:
    - spring-mvc
    - openapi
  disabled: []

detectors:
  excessive_data_exposure_java:
    enabled: yes
    properties:
      minConfidence: high
  pii_leak_in_response_java:
    enabled: yes
    severity: high
  jwt_misconfiguration:
    enabled: yes
  mass_assignment:
    enabled: yes
    properties:
      protectedAttributes:
        - admin
        - role
        - isAdmin
        - balance
        - tenantId          # project-specific privileged field
  rate_limit_absence:
    enabled: no             # gateway-level limits are in place

sensitivityClassifier:
  ignore:
    - com.acme.user.NewsletterSubscriber#email
```

```bash
xygeni apisecurity --dir . -c xygeni.apisecurity.yml -f json -o report.json --fail-on high
```

--------------------------------

### Verify xy-dast installation

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Checks that the wrapper is installed and accessible. If command not found, revisit Step 1.

```bash
xy-dast --version
```
Tokens:
Raw