PWN Security Automation Framework Integration with DefectDojo

PWN Security Automation Framework Integration with DefectDojo

PWN is an open source security automation framework written in Ruby and distributed as the pwn gem, developed in the 0dayInc organization on GitHub. It bundles many security modules and command-line drivers. One of them, pwn_sast, scans source code repositories for security anti-patterns using a library of SAST test cases, and ties each match to a CWE and a NIST 800-53 security control. The driver writes its results as a JSON file alongside an HTML report, and DefectDojo imports the JSON.

PWN Security Automation Framework Integration with DefectDojo

We use pwn_sast as a fast pattern sweep across repositories, and DefectDojo is where those matches get reviewed and assigned. Every hit becomes a Finding on the Asset that owns the repository, with the file path, the offending line of code, the commit author, the CWE, and the NIST 800-53 control it relates to. Because each finding carries a stable tool ID, re-running the sweep and reimporting tells us what changed instead of handing us the same list again.

Why PWN Matters

Pattern-based source scanning is blunt, but it is quick, transparent, and easy to run against many repositories at once.

• Each pwn_sast test case is a PWN::SAST module that targets one anti-pattern (for example PWN::SAST::Eval for dynamic code evaluation), and you can list and pick test cases per run.
• Results map to NIST 800-53 control families and CWE entries, which helps teams that report against those frameworks.
• The output records who committed the offending line, which shortens the step from finding to owner.
• Matches are candidates, not confirmed vulnerabilities. Without somewhere to triage and remember decisions, the same false positives come back on every run.

Advantages of This Integration

What we gained by sending pwn_sast results through DefectDojo:

• Deduplication on the tool's identity. PWN SAST findings are deduplicated by the unique ID from the tool, a hash of the offending file URI and the line contents. A finding keeps its identity even if the line number shifts.
• Lifecycle on reimport. Reimporting a new run into the same Test mitigates matches that were removed, adds new ones, and reactivates any that return.
• Triage that persists. Marking a match as a false positive or accepting its risk in DefectDojo holds across reimports, which is what makes a pattern scanner usable over time.
• Framework context on every finding. The NIST 800-53 control and CWE references travel with the finding into reports and Jira tickets.
• Assignment by author. The commit author in the description gives a starting point for routing work to the right engineer or team.

How This Integration Works

DefectDojo imports these results with the PWN SAST scan type.

1. Run pwn_sast. Install the gem, then run the driver from the root of the repository. --uri-source-root is required and should be the browsable HTTP URI of the repository, which pwn_sast uses to build links to the offending files:

gem install pwn
pwn_sast --dir-path . --uri-source-root "https://git.example.com/acme/storefront/tree/main" --report-name storefront

The driver writes storefront.json and storefront.html to the directory given in --dir-path. Use -l to list the available test cases and -T to run a subset. Import the JSON file.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select PWN SAST, and upload the file. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=PWN SAST" \
  -F "file=@storefront.json" \
  -F "product_name=storefront" \
  -F "engagement_name=Source Sweep" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "PWN SAST" \
  --report-path "./storefront.json" \
  --product-name "storefront" \
  --engagement-name "Source Sweep" \
  --auto-create-context

3. Reimport on later runs. Send subsequent reports to /api/v2/reimport-scan/ against the same Test so the finding history for the repository stays in one place.

Data Granularity: What Gets Imported

The report holds one entry per test case and file, each with a list of matching lines. DefectDojo creates one finding per matching line.

The line number appears in the title and description but is not written to the finding's line field.

Use Cases

For a quick sweep across many repositories: A security team runs pwn_sast against every repository in an organization on a weekly schedule and reimports each into its own Asset. New matches show up as new findings, and triaged ones stay quiet.

For compliance-oriented programs: Teams that report against NIST 800-53 can filter findings by the control family in the Impact field and show which source-level anti-patterns map to which controls.

Alongside a deeper SAST tool: pwn_sast is transparent about what it matches, so teams use it next to a dataflow-based scanner. Both import into the same Asset, and the pattern findings help explain why the deeper tool flagged a file.

For onboarding acquired code: When a company takes over a new codebase, a first pwn_sast import gives a rough map of risky patterns and their authors before a full review.

Operational Tips

• Plan to set severity yourself. Every PWN SAST finding arrives as Info, so either raise the ones that matter during triage or exclude Info from SLA reporting for this scan type.
• Use -T to run only the test cases your team acts on. A focused run produces fewer findings to triage and a cleaner history.
• Keep --uri-source-root consistent between runs. It is part of the offending URI that feeds the unique ID, so changing it (for example from a branch URL to a commit URL) gives every finding a new identity.
• Expect titles to change when code moves. The title includes the line number, but deduplication uses the content-based unique ID, so a moved line is still recognized as the same finding.
• Mark matches in test fixtures or vendored code as false positives once; the decision will hold on reimport.
• Tag imports with the branch or commit (for example tags=main) to separate scheduled sweeps from ad hoc runs.