臺灣博碩士論文加值系統

軟體測試無疑是軟體開發過程中極為重要且不能被忽略的環節，因軟體的問題形成源，通常從軟體開發初期的小問題，經過不斷的累積到結束後的軟體整合期，才發現軟體存在大問題，造成軟體在整合期間，消耗大量的時間於整修上，持續的軟體測試是有效提升軟體品質與解決軟體問題形成前的不二法門。雖然目前有許多軟體品質的工具可供使用，如效能測試、接受度測試（Acceptance Testing）、單元測試等，但對於軟體持續整合與弱點測試的相關工具仍有待開發。軟體持續交付的開發方法DevOps（源於Development和Operations 2字的縮寫組合）為最近軟體實務業界最廣為討論的議題之一，面對快速演進的技術與日新月異的應用，使用者與企業希望軟體能持續不斷地被更新與加入新功能，DevOps是許多網路應用以及大型雲端服務能夠快速版本更新的主要秘訣之一，然而DevOps開發方法需要開發與維運團隊之間更緊密合作，並且在開發階段就能夠持續的進行測試與整合，但這些測試需要新的工具來支援方能有效達成。本論文的主要目的即是，開發一個軟體持續整合與弱點測試系統，透過弱點檢測功能的導入，讓開發團隊能在軟體開發期間，就能檢測出軟體的問題源，並在問題形成大問題前把其修復，提升與維持軟體品質。

Software testing play an important role in software development process which cannot been ignored and overlooked by most of the parties in the market today. Software problem it normally happens in the early development stage and this problem is easily ignored or does not alert by software tester. When this issue went through each of the software development process and continuously accumulation the problem to has dependencies affected the software architecture to become a major software issue in the system. It is too late for software tester to detect of this software problem, resulting a lot of resources and time consumption with high development cost require in the renovation. In order to improve the software quality and resolve the issue in the early development stage, software testing must be performed continuously at the initial state before it can be release to the market. Although there are a lot of testing tools available to use in Functional Test, Acceptance test, Security test and Unit testing but tools for software integration testing still rarely found in market. DevOps, a software development and delivery process that emphasized collaboration and communication between software development, product management and operations professionals has now become one of the most popular discussed topics in the recent software industry. Due to the reason of rapid evolution in technology, users and business organization always wanted the software can be continually updated in the first place, DevOps is the key element that could help to resolve in this request. DevOps currently has been widely used in many online application and large cloud services due to its quickly update abilities. However, the DevOps development approach requires the corporations between the development and the maintenance teams so that it can be able to continuously test and integrate the software during the development phase which requires a support from new tools. The main purpose of this thesis is to develop a software that combine software integration and vulnerability scanning testing system. Throughout the import of the vulnerability scanning function, software development team can be easily detected the software problem in the early development stage to repair, enhance and maintain the software quality before the problem become major and complicated that nearly impossible to fix.

摘 要 i
ABSTRACT ii
致謝 iii
表目錄 vi
圖目錄 vii
一、緒論 1
1-1前言 1
1-2研究動機 1
1-3研究目的 2
1-4論文架構 2
二、 相關研究 3
2-1 DevOps介紹 3
2-2 版本控制 5
2-3 弱點測試介紹 7
2-4 網頁常見弱點（OWASP Top10）10
2-5 持續整合相關工具 12
2-6 弱點測試相關工具 13
2-6-1 SonarQube 13
2-6-2 RIPS 16
2-6-3 jsLint與CssLint 16
2-6-4 W3af 16
2-6-5 ZAP 18
2-6-6 Wapiti 18
2-6-7 Nikto 19
三、系統分析與設計 21
3-1系統分析 21
3-2系統架構與設計 22
四、系統實作 24
4-1 Scanner Server 驅動方式 24
4-2 建立專案建置 25
4-3 弱點檢測功能設定與檢測結果 25
4-4 個弱點檢測功能之間的功能對比 28
五、結論與未來方向 29
5-1 結論 29
5-2 未來方向 29
參考文獻 30

[1]Edwards, Damon. What is DevOps?.
[2]DevOps百度百科：https://baike.baidu.com/item/devops
[3]Lyman, Jay. DevOps mixing dev, ops, agile, cloud, open source and business. 451 CAOS Theory.
[4]Tower “什麼是版本控制?”:https://www.git-tower.com/learn/git/ebook/cn/command-line/basics/what-is-version-control
[5]Tower “為什麼需要版本控制?”:https://www.git-tower.com/learn/git/ebook/cn/command-line/basics/why-use-version-control
[6] “版本控制”百度百科：https://baike.baidu.com/item/%E7%89%88%E6%9C%AC%E6%8E%A7%E5%88%B6
[7]網絡攻防原理與技術第2版 吳禮發、洪征、李華波 編著
[8]網站滲透測試實務入門 陳明照 編著
[9]白帽駭客新兵訓練營地 陳明照 編著
[10]OWASP:https://www.owasp.org/index.php/Main_Page
[11]OWASP Top10:https://www.owasp.org/index.php/Top_10_2013-Top_10
[12]Jenkins 權威指南 John Ferguson Smart 著
[13]Jenkins官方使用手冊:https://jenkins.io/doc/
[14]Tutorialspoint: https://www.tutorialspoint.com/jenkins/
[15]SonarQube Documentation: https://docs.sonarqube.org/display/SONAR/Documentation
[16]何為技術負債：https://zh.wikipedia.org/wiki/%E6%8A%80%E6%9C%AF%E8%B4%9F%E5%80%BA
[17]Kali Linux 滲透測試工具 陳明照 編著
[18]防駭超級工具，歐萊禮，楊仁和譯，2008年02月
[19]W3af Online : http://w3af.org/
[20]ZAP Online ：https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project