Practical Security Automation and Testing

Step 2 – run security tools to output XMLs

Generally, most security testing tools can output testing results in XML or JSON format. In our demonstration, we generate most of the results in XML files and import them into OWASP DefectDojo.

This table shows some common security testing tools for how to execute the security testing with XML output:

Tools	Security testing, output format and command options
OWASP ZAP	Web Security testing with XML output format: $ zap-cli quick-scan -s xss,sqli --spider -r http://nodegoat.herokuapp.com/ $ zap-cli report -o ZAP_Report.xml -f xml
Dependency Check	Scan for known vulnerabilities with XML output format: $ dependency-check.bat --format XML --project NodeGoat -s d:\NodeGoat
NMAP	Network ...