Use the CLI
Know and reproduce the scanner’s OWASP Benchmark results
Fluid Attacks uses the OWASP Benchmark At Fluid Attacks, we care about the accuracy of security testing results. This means we want to make sure that the automated tools and security analysts involved make as few mistakes as possible in their ...
Validate CASA tier 2 requirements
CASA requirements are based on the OWASP Application Security Verification Standard (ASVS); failure to implement them is associated with CWE entries. A software application must meet all 73 CASA requirements, regardless of their CWE rating, to pass ...
Contribute to enhancing the scanner
Fluid Attacks' scanner, like the company's other products, is open source. Currently, Fluid Attacks does not allow contributions from third parties. However, Fluid Attacks welcomes feature requests and bug reports. To submit such matters, you can ...
Exclude findings from scan reports
Fluid Attacks offers the NOFLUID feature to allow you to exclude from reports some specific, potentially insecure lines within your application's source code or infrastructure-as-code (IaC) configurations. This way you can avoid findings that might ...
Understand the scanner output
Fluid Attacks' standalone scanner provides varying levels of detail in its output, depending on the chosen format. This page provides a detailed explanation of each field present in the standalone scanner output. The CLI snippets and CSV files are ...
Run scans locally or in your CI/CD
Run the Fluid Attacks scanner locally You can run the Docker container with docker run -v /dir/to/scan:/my-dir fluidattacks/cli:latest skims scan /my-dir where /dir/to/scan is the path to the directory you want to scan. You can also pass custom ...
Configure the tests by the standalone scanner
Fluid Attacks' scanner is a security vulnerability detection tool. This means it scans your source-code, infrastructure and applications and reports to you the security problems they have. The scanner can be used by users in two modes: As a paid ...