SAMMY Open Source v2

This repository hosts the open source version of SAMMY - the OWASP SAMM tool.

License

This project is licensed under the Creative Commons Attribution-ShareAlike 4.0 International License. See the LICENSE file for details.

SAMMY v2

• The setup comes with a predefined user injected in the database:
  • username: [email protected]
  • password: admin
  • mfa key: AB4FHDUHYVGW7IAB (add this key to your authenticator app manually)

How to run it without docker

Requirements

• MySQL or MariaDB
• Redis (only if you want to run it in APP_ENV=prod)
• php8.2+
• composer

Optional

• Symfony CLI (https://symfony.com/download)

How to run it

1. Create .env.local file with your local setup. Example with MariaDB:
   • in case of any other DB here you can find proper connection string - https://www.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/configuration.html#connecting-using-a-url

DATABASE_URL=mysql://root:[email protected]:3306/sammy?serverVersion=11.3.2-MariaDB
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
APP_ENV=dev
APP_DEBUG=1

2. install & run

composer install
./scripts/setup_database.sh
# if you have symfony cli
symfony server:start --allow-http
# else
php -S 0.0.0.0:8000 -t ./public
open http://127.0.0.1:8000

How to run it with docker

# 1. start DB and Redis
docker compose up -d db redis
# 2. now we can start our application
docker compose up -d --build app
# 3. sync SAMM model. Note, this step syncs the SAMM model from the core GitHub repo. You only have to run this the very first time and upon every SAMM model update.
docker compose exec app ./scripts/sync_samm.sh
# 4. Enjoy
open http://127.0.0.1:8000

Mailing

• If you want to use mailing feature you have to add following to your .env.local or compose.yaml file. All fields are Required. Also, server should use proper SSL.
  • for .env.lcoal

    PHPMAILER_SMTP_HOST=
    PHPMAILER_SMTP_PORT=
    PHPMAILER_SMTP_USERNAME=
    PHPMAILER_SMTP_PASSWORD=

    • for compose.yaml under app section under environment

    - PHPMAILER_SMTP_HOST=
    - PHPMAILER_SMTP_PORT=
    - PHPMAILER_SMTP_USERNAME=
    - PHPMAILER_SMTP_PASSWORD=

• If you are using docker you do not have to do anything else. There is a cronjob which runs every 2 minutes.
• If you are running this locally you have to run following command manually:

php ./bin/console app:process-mailing