Web Security Scanner for OWASP Compliance with Markdown Reports

This n8n workflow provides a streamlined solution for performing web security scans, specifically tailored for OWASP compliance. Upon a form submission, it initiates a security scan against a specified URL, processes the results, and generates a comprehensive Markdown report. The report is then sent via email, allowing for quick dissemination of critical security findings.

What it does

This workflow automates the following steps:

1. Triggers on Form Submission: The workflow starts when a user submits data through an n8n form. This form is expected to provide the target URL for the security scan.
2. Initiates HTTP Request: An HTTP Request node is used to interact with an external web security scanning API (e.g., an OWASP ZAP or similar scanner endpoint). The target URL from the form submission is passed to this API.
3. Processes Scan Results: The raw data from the security scan API is processed. This likely involves parsing JSON or XML responses to extract relevant findings.
4. Generates Markdown Report: A Code node dynamically creates a structured Markdown report based on the parsed scan results. This report highlights key vulnerabilities, their severity, and potentially remediation steps.
5. Attaches Report as File: The generated Markdown content is converted into a file attachment.
6. Sends Email with Report: Finally, a Gmail node sends an email containing the Markdown report as an attachment to a predefined recipient, ensuring that the security findings are promptly delivered.

Prerequisites/Requirements

To use this workflow, you will need:

• n8n Instance: A running instance of n8n.
• Web Security Scanner API: Access to a web security scanner API (e.g., a self-hosted OWASP ZAP instance with an API, or a commercial web scanner). The HTTP Request node will need to be configured with the appropriate endpoint and authentication.
• Gmail Account: A configured Gmail credential in n8n to send email notifications.
• n8n Form: A pre-configured n8n form that collects the target URL for the scan.

Setup/Usage

1. Import the Workflow: Import the provided JSON into your n8n instance.
2. Configure the n8n Form Trigger:
   • Open the "On form submission" node.
   • Ensure the form is set up to capture the target URL for the scan. The output of this form should contain a field that can be referenced by the HTTP Request node (e.g., {{ $json.url_to_scan }}).
3. Configure the HTTP Request Node:
   • Open the "HTTP Request" node.
   • Set the URL to your web security scanner's API endpoint.
   • Configure the Method (e.g., POST, GET) and any necessary Headers or Body parameters, including passing the target URL from the "On form submission" node (e.g., {{ $('On form submission').item.json.url_to_scan }}).
   • Add any required authentication (e.g., API keys, basic auth) to the HTTP Request node's credentials.
4. Configure the Code Node:
   • Open the "Code" node.
   • Review and customize the JavaScript code to parse the output of your specific web security scanner API and format it into a Markdown string. The current code expects to receive scan results from the previous HTTP Request node.
5. Configure the Convert to File Node:
   • Open the "Convert to File" node.
   • Ensure it's configured to convert the Markdown output from the "Code" node into a file (e.g., report.md).
6. Configure the Gmail Node:
   • Open the "Gmail" node.
   • Select your Gmail credential.
   • Set the To email address where the reports should be sent.
   • Customize the Subject and Body of the email.
   • Ensure the Attachments section is configured to include the file output from the "Convert to File" node.
7. Activate the Workflow: Save and activate the workflow.

Once activated, submitting the n8n form with a target URL will trigger a web security scan, generate a Markdown report, and email it to the specified recipient.