#!/bin/bash # Initialize Trivy vulnerability scanning test environment # Function to check if command exists command_exists() { command -v "$1" >/dev/null 2>&1 } # Step 1: Install Trivy from GitHub release echo "Step 1: Installing Trivy from GitHub..." if command_exists trivy; then echo "✓ Trivy is already installed" trivy --version else # Download Trivy cd /tmp wget -q https://github.com/aquasecurity/trivy/releases/download/v0.69.3/trivy_0.69.3_Linux-64bit.tar.gz if [ $? -ne 0 ]; then echo "✗ Failed to download Trivy" exit 1 fi echo "✓ Downloaded Trivy" # Extract the archive echo "Extracting Trivy..." tar -xzf trivy_0.69.3_Linux-64bit.tar.gz if [ $? -ne 0 ]; then echo "✗ Failed to extract Trivy" exit 1 fi echo "✓ Extracted Trivy" # Move to /usr/local/bin echo "Installing Trivy to /usr/local/bin..." sudo mv trivy /usr/local/bin/ sudo chmod +x /usr/local/bin/trivy # Cleanup rm -f trivy_0.69.3_Linux-64bit.tar.gz rm -f README.md LICENSE contrib.md if command_exists trivy; then echo "✓ Trivy installed successfully" trivy --version else echo "✗ Failed to install Trivy" exit 1 fi fi echo "" # Step 2: Create /opt/app directory echo "Step 2: Creating application directory..." sudo mkdir -p /opt/app sudo chown $(whoami):$(whoami) /opt/app echo "✓ Created /opt/app directory" echo "" # Step 3: Create simple vulnerable application files echo "Step 3: Creating vulnerable application files..." # Create a Dockerfile with old Alpine base image (has known vulnerabilities) cat > /opt/app/Dockerfile << 'EOF' FROM alpine:3.10 RUN apk add --no-cache \ curl=7.66.0-r0 \ openssl=1.1.1d-r0 \ busybox=1.30.1-r2 WORKDIR /app COPY app.sh . CMD ["sh", "app.sh"] EOF echo "✓ Created Dockerfile with old Alpine 3.10 base image" # Create a simple shell script cat > /opt/app/app.sh << 'EOF' #!/bin/sh echo "Sample application running..." while true; do sleep 60 done EOF chmod +x /opt/app/app.sh echo "✓ Created app.sh" # Create a docker-compose.yml with old image versions cat > /opt/app/docker-compose.yml << 'EOF' version: '3.3' services: web: image: nginx:1.16.0 ports: - "80:80" redis: image: redis:5.0.5 ports: - "6379:6379" postgres: image: postgres:11.5 environment: POSTGRES_PASSWORD: example EOF echo "✓ Created docker-compose.yml with old container images" # Create a config file that might contain secrets cat > /opt/app/config.yaml << 'EOF' database: host: localhost port: 5432 username: admin password: SuperSecret123! api: key: sk-1234567890abcdef1234567890abcdef secret: abcdef1234567890abcdef1234567890 aws: access_key: AKIAIOSFODNN7EXAMPLE secret_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY EOF echo "✓ Created config.yaml with sample secrets" # Create a .env file with secrets cat > /opt/app/.env << 'EOF' DATABASE_URL=postgresql://user:password123@localhost:5432/mydb API_TOKEN=ghp_1234567890abcdefghijklmnopqrstuvwxyz AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY STRIPE_SECRET_KEY=sk_live_1234567890abcdef1234567890abcdef EOF echo "✓ Created .env file with sample secrets" # Create a simple README cat > /opt/app/README.md << 'EOF' # Vulnerable Test Application This application uses: - Alpine Linux 3.10 (has known vulnerabilities) - Old versions of nginx, redis, postgres - Sample configuration files with hardcoded secrets Used for testing Trivy vulnerability and secret scanning. EOF echo "✓ Created README.md" echo "" # Step 5: Display summary echo "==========================================" echo "Test Environment Setup Complete!" echo "==========================================" echo "" echo "Summary:" echo " ✓ Trivy installed: $(trivy --version 2>&1 | grep Version | head -n1)" echo " ✓ Vulnerable app created: /opt/app/" echo "" echo "Vulnerable components included:" echo " - Dockerfile with Alpine 3.10 base image" echo " - docker-compose.yml with old nginx, redis, postgres images" echo " - Configuration files with hardcoded secrets" echo "" echo "Files created in /opt/app/:" ls -lh /opt/app/ echo ""

Devops Interview Questions

Filters