DAST: integrate Nuclei as a deterministic detector under the agentic layer (DAST phase + Werkbank job, incl. ICS/OT templates) #234

New Issue

2026-08-31T13:14:01Z

sharang commented

2026-08-31 13:14:01 +00:00

Why

Spec v0.2.1 (Collectives › Certifai SPS Approach › §4.1 row 5, R-D2, R-D4): the agentic DAST/pentest stays the differentiator, but web DAST is not the moat, LLM findings are non-deterministic, and the control-mapping design is "tools detect, the LLM judges". Nuclei gives us thousands of maintained deterministic templates (CVE checks, default credentials, exposed admin panels, misconfigurations) including ICS/OT templates (Modbus, S7, exposed HMIs) — the first real posture source for WebVisu / OpenPLC / HMI endpoints (R-D4) and a reproducible baseline for the nightly regression (#188).

Documented as a decided integration in docs/reference/tools.md (Planned integrations) and docs/features/control-mapping.md; this issue is the source-code half.

Scope

Runner: nuclei binary in the image that executes dynamic jobs (Werkbank Docker executor first; Dockerfile.agent only if the embedded DAST path still runs there). Pin a version; vendor the templates dir (offline-friendly, on-prem).
Job / phase: new ScanType::NucleiScan (or fold into Dast with scanner = "nuclei"), runs against every LiveUrl artifact and against the provisioned soft-PLC endpoints (WebVisu HTTP + Modbus/OPC UA via the ICS template set). Respect target rate limit / excluded paths / auth from WebArtifactConfig.
Parser: nuclei JSONL → Finding (rule_id = template-id, severity from template, cwe from classification.cwe-id, cve from classification.cve-id, matched URL + matcher name as evidence). Dedup via existing fingerprint.
Control mapping: add nuclei rows to control-map/data/cra_control_map.json (tool = nuclei, key = template-id or CWE) so findings get control_refs through the existing LUT → grounded judge path.
Agentic layer: pass nuclei results into the DAST/pentest system prompt as seed context (like SAST findings are today).
Docs: move nuclei from "Planned integrations" to the live tool list in docs/reference/tools.md; update docs/features/dast.md.

Acceptance

Juice Shop demo target (fixtures/demo-targets, PR #232) yields nuclei findings with CWE + control_refs, visible in findings list and oscal_assessment.
Provisioned OpenPLC (epic #183 path) yields at least the default-credential / exposed-panel templates.
Runs offline with vendored templates (on-prem Werkbank requirement).
Golden baseline entry added to the demo-target manifest expect for #188.

Relates: #186, #188, #183, werkbank#1. Spec: R-D2, R-D4.

## Why Spec v0.2.1 (Collectives › Certifai SPS Approach › §4.1 row 5, R-D2, R-D4): the agentic DAST/pentest stays the differentiator, but web DAST is not the moat, LLM findings are non-deterministic, and the control-mapping design is "tools detect, the LLM judges". Nuclei gives us thousands of maintained deterministic templates (CVE checks, default credentials, exposed admin panels, misconfigurations) **including ICS/OT templates** (Modbus, S7, exposed HMIs) — the first real posture source for WebVisu / OpenPLC / HMI endpoints (R-D4) and a reproducible baseline for the nightly regression (#188). Documented as a decided integration in `docs/reference/tools.md` (Planned integrations) and `docs/features/control-mapping.md`; this issue is the source-code half. ## Scope 1. **Runner**: `nuclei` binary in the image that executes dynamic jobs (Werkbank Docker executor first; `Dockerfile.agent` only if the embedded DAST path still runs there). Pin a version; vendor the templates dir (offline-friendly, on-prem). 2. **Job / phase**: new `ScanType::NucleiScan` (or fold into `Dast` with `scanner = "nuclei"`), runs against every `LiveUrl` artifact and against the provisioned soft-PLC endpoints (WebVisu HTTP + Modbus/OPC UA via the ICS template set). Respect target rate limit / excluded paths / auth from `WebArtifactConfig`. 3. **Parser**: nuclei JSONL → `Finding` (rule_id = template-id, severity from template, `cwe` from `classification.cwe-id`, `cve` from `classification.cve-id`, matched URL + matcher name as evidence). Dedup via existing fingerprint. 4. **Control mapping**: add nuclei rows to `control-map/data/cra_control_map.json` (tool = nuclei, key = template-id or CWE) so findings get `control_refs` through the existing LUT → grounded judge path. 5. **Agentic layer**: pass nuclei results into the DAST/pentest system prompt as seed context (like SAST findings are today). 6. **Docs**: move nuclei from "Planned integrations" to the live tool list in `docs/reference/tools.md`; update `docs/features/dast.md`. ## Acceptance - [ ] Juice Shop demo target (fixtures/demo-targets, PR #232) yields nuclei findings with CWE + control_refs, visible in findings list and `oscal_assessment`. - [ ] Provisioned OpenPLC (epic #183 path) yields at least the default-credential / exposed-panel templates. - [ ] Runs offline with vendored templates (on-prem Werkbank requirement). - [ ] Golden baseline entry added to the demo-target manifest `expect` for #188. Relates: #186, #188, #183, werkbank#1. Spec: R-D2, R-D4.

sharang added the enhancement label 2026-08-31 13:14:01 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#234