{"id":78842,"date":"2026-10-03T05:45:20","date_gmt":"2026-10-03T05:45:20","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=78842"},"modified":"2026-10-03T05:45:23","modified_gmt":"2026-10-03T05:45:23","slug":"owasp-dependency-check-1-hour-quick-demo-lab","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/owasp-dependency-check-1-hour-quick-demo-lab\/","title":{"rendered":"OWASP Dependency-Check \u2014 1-Hour Quick Demo Lab"},"content":{"rendered":"\n

Level:<\/strong> Beginner \/ Basic DevSecOps
Duration:<\/strong> 60 minutes
Format:<\/strong> Instructor-led hands-on demo
Focus:<\/strong> Install \u2192 scan a real project \u2192 read findings \u2192 understand CVE\/CVSS \u2192 generate reports \u2192 demonstrate a simple security gate<\/p>\n\n\n\n

\n\n\n\n

Lab Version<\/h2>\n\n\n
Tutorial<\/span> verified<\/span> for<\/span>: October<\/span> 2026\nOWASP<\/span> Dependency-Check<\/span>: 13.0<\/span>.0<\/span>\nRecommended<\/span> Java<\/span> runtime<\/span>: Java<\/span> 17 LTS<\/span>\nMinimum<\/span> Java<\/span> runtime<\/span>: Java<\/span> 11\nSample<\/span> project<\/span>: OWASP<\/span> NodeGoat<\/span>\nPinned<\/span> sample<\/span> commit<\/span>: 9336e34<\/span>\nPrimary<\/span> report<\/span> format<\/span>: HTML<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n
Important for a 1-hour class:<\/strong> Dependency-Check must download vulnerability data before it can perform useful analysis. The first update can take significant time. The instructor should pre-populate the Dependency-Check data directory before the session, or provide students with a prepared lab VM\/environment.<\/p>\n<\/blockquote>\n\n\n\n
\n\n\n\n
1. Learning Objectives<\/h1>\n\n\n\n
By the end of this 60-minute lab, students should be able to:<\/p>\n\n\n\n
    \n
  • Explain what OWASP Dependency-Check does.<\/li>\n\n\n\n
  • Explain why Software Composition Analysis (SCA) matters.<\/li>\n\n\n\n
  • Verify a Dependency-Check installation.<\/li>\n\n\n\n
  • Scan a real GitHub project.<\/li>\n\n\n\n
  • Generate an HTML vulnerability report.<\/li>\n\n\n\n
  • Identify the affected dependency, CVE, severity, and CVSS score.<\/li>\n\n\n\n
  • Understand why a detected vulnerability still needs investigation.<\/li>\n\n\n\n
  • Generate a machine-readable report.<\/li>\n\n\n\n
  • Demonstrate a simple CVSS-based security gate.<\/li>\n\n\n\n
  • Explain where Dependency-Check fits into CI\/CD.<\/li>\n<\/ul>\n\n\n\n
    \n\n\n\n
    2. 60-Minute Agenda<\/h1>\n\n\n\n
    Time<\/th>Activity<\/th><\/tr><\/thead>
    0\u20135 min<\/td>SCA and Dependency-Check overview<\/td><\/tr>
    5\u201312 min<\/td>Environment and installation verification<\/td><\/tr>
    12\u201318 min<\/td>Clone the real sample application<\/td><\/tr>
    18\u201332 min<\/td>Run the first Dependency-Check scan<\/td><\/tr>
    32\u201343 min<\/td>Read the HTML report<\/td><\/tr>
    43\u201350 min<\/td>CVE, CVSS, severity, evidence, and false positives<\/td><\/tr>
    50\u201355 min<\/td>JSON report + simple security gate<\/td><\/tr>
    55\u201360 min<\/td>CI\/CD placement, validation, recap<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \n\n\n\n
    3. What Is OWASP Dependency-Check?<\/h1>\n\n\n\n
    OWASP Dependency-Check is a Software Composition Analysis tool that identifies publicly disclosed vulnerabilities in third-party software components used by an application.<\/p>\n\n\n\n
    A simplified workflow is:<\/p>\n\n\n
    Application source code\n        \u2193\nDependency manifests \/ packages\n        \u2193\nOWASP Dependency-Check\n        \u2193\nComponent identification\n        \u2193\nKnown vulnerability matching\n        \u2193\nCVE \/ CVSS information\n        \u2193\nHTML \/ JSON<\/span> \/ XML \/ SARIF reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Dependency-Check helps answer questions such as:<\/p>\n\n\n
    What third-party components are we using?\n        \u2193\nAre known vulnerabilities associated with<\/span> those components?\n        \u2193\nHow severe are the findings?\n        \u2193\nDo the findings actually apply to our application?\n        \u2193\nShould we upgrade, mitigate, suppress, or investigate further?\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n
    Key lesson:<\/strong> A Dependency-Check finding is a security signal that requires analysis. It is not automatic proof that the application is exploitable.<\/p>\n<\/blockquote>\n\n\n\n
    \n\n\n\n
    4. Prerequisites<\/h1>\n\n\n\n
    Student workstation<\/h2>\n\n\n\n
    Recommended environment:<\/p>\n\n\n
    Ubuntu 22.04\/24.04+ or current macOS\nJava 17\nGit\nunzip\nInternet access\nOWASP Dependency-Check 13.0.0\n<\/code><\/span><\/pre>\n\n\n
    Recommended resources:<\/p>\n\n\n
    CPU<\/span>: 2+ cores\nRAM<\/span>: 4 GB minimum, 8 GB recommended\nDisk<\/span>: 3+ GB free for the lab and vulnerability data\n<\/code><\/span>Code language:<\/span> HTTP<\/span> (<\/span>http<\/span>)<\/span><\/small><\/pre>\n\n\n
    Verify Java<\/h2>\n\n\n
    java -version\n<\/code><\/span><\/pre>\n\n\n
    Example:<\/p>\n\n\n
    openjdk<\/span> version<\/span> \"17.x<\/span>.x<\/span>\"\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    Verify Git<\/h2>\n\n\n
    git --version\n<\/code><\/span><\/pre>\n\n\n
    Example:<\/p>\n\n\n
    git<\/span> version<\/span> 2.x<\/span>.x<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n\n
    5. Install Dependency-Check<\/h1>\n\n\n\n
    If the instructor has already prepared Dependency-Check, students can skip directly to Installation Verification<\/strong>.<\/p>\n\n\n\n
    Linux\/macOS \u2014 CLI distribution<\/h2>\n\n\n\n
    Create a lab tools directory:<\/p>\n\n\n
    mkdir -p ~\/odc-lab\ncd ~\/odc-lab\n<\/code><\/span><\/pre>\n\n\n
    Download the 13.0.0 CLI distribution:<\/p>\n\n\n
    curl -LO https:\/\/github.com\/dependency-check\/DependencyCheck\/releases\/download\/v13.0.0\/dependency-check-13.0.0-release.zip<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Extract it:<\/p>\n\n\n
    unzip<\/span> dependency-check-13<\/span>.0<\/span>.0-release<\/span>.zip<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    The executable is located under:<\/p>\n\n\n
    dependency-check\/bin\/\n<\/code><\/span><\/pre>\n\n\n
    Installation Verification<\/h2>\n\n\n\n
    Run:<\/p>\n\n\n
    .\/dependency-check\/bin\/dependency-check.sh --version\n<\/code><\/span><\/pre>\n\n\n
    Expected result:<\/p>\n\n\n
    Dependency-Check<\/span> Core<\/span> version<\/span> 13.0<\/span>.0<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n
    On Windows, use dependency-check.bat<\/code> instead of dependency-check.sh<\/code>.<\/p>\n<\/blockquote>\n\n\n\n
    \n\n\n\n
    6. Instructor Preparation \u2014 Do This Before Class<\/h1>\n\n\n\n
    A first-time vulnerability database update can consume much of a 60-minute lab. Pre-populate the data directory.<\/p>\n\n\n\n
    Create a reusable data directory:<\/p>\n\n\n
    mkdir -p ~\/odc-lab\/<\/span>odc-data\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    If an NVD API key is available:<\/p>\n\n\n
    export<\/span> NVD_API_KEY=\"YOUR_NVD_API_KEY\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Populate\/update Dependency-Check data:<\/p>\n\n\n
    ~\/odc-lab\/<\/span>dependency-check\/bin\/dependency-check.sh \\\n  --updateonly \\\n  --data ~\/odc-lab\/<\/span>odc-data \\\n  --nvdApiKey \"$NVD_API_KEY\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    If no API key is available, the instructor can perform the update without --nvdApiKey<\/code>, but updates can be considerably slower and are more likely to encounter rate limiting.<\/p>\n\n\n\n
    For the live class, reuse the same data directory:<\/p>\n\n\n
    ~\/odc-lab\/<\/span>odc-data\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n\n
    7. Clone the Real Sample Application<\/h1>\n\n\n\n
    For this quick demo we use OWASP NodeGoat<\/strong>, a deliberately vulnerable application maintained for security training.<\/p>\n\n\n\n
    Step 1 \u2014 Clone NodeGoat<\/h2>\n\n\n
    cd ~\/odc-lab\ngit clone<\/span> https:\/\/github.com\/OWASP\/NodeGoat.git<\/span>\ncd NodeGoat\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    Step 2 \u2014 Pin the lab revision<\/h2>\n\n\n
    git checkout 9336e34\n<\/code><\/span><\/pre>\n\n\n
    Expected output is similar to:<\/p>\n\n\n
    HEAD is now at 9336e34 ...\n<\/code><\/span><\/pre>\n\n\n
    Step 3 \u2014 Confirm dependency files<\/h2>\n\n\n
    ls<\/span> package<\/span>.json<\/span> package-lock<\/span>.json<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    Expected:<\/p>\n\n\n
    package-lock<\/span>.json<\/span>\npackage<\/span>.json<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    Why pin the commit?<\/h3>\n\n\n\n
    Using an immutable Git commit keeps the training project stable even if the NodeGoat default branch changes later.<\/p>\n\n\n\n
    \n\n\n\n
    8. Understand the Project Before Scanning<\/h1>\n\n\n\n
    Inspect the beginning of the dependency manifest:<\/p>\n\n\n
    head<\/span> -40<\/span> package<\/span>.json<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    Optional quick dependency search:<\/p>\n\n\n
    grep -n 'marked'<\/span> package.json package-lock.json | head\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    The pinned training revision contains intentionally old dependencies. This gives Dependency-Check useful material to analyze.<\/p>\n\n\n\n
    \n
    We are not<\/strong> trying to run NodeGoat in this lab. The goal is to analyze its third-party dependencies.<\/p>\n<\/blockquote>\n\n\n\n
    \n\n\n\n
    9. Run the First Dependency-Check Scan<\/h1>\n\n\n\n
    Create a report directory:<\/p>\n\n\n
    mkdir -p ~\/odc-lab\/<\/span>reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    From the NodeGoat directory, run:<\/p>\n\n\n
    ~\/odc-lab\/<\/span>dependency-check\/bin\/dependency-check.sh \\\n  --project \"OWASP NodeGoat Quick Lab\"<\/span> \\\n  --scan . \\\n  --data ~\/odc-lab\/<\/span>odc-data \\\n  --format HTML \\\n  --out ~\/odc-lab\/<\/span>reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    If the environment is not pre-populated and an NVD API key is available, add:<\/p>\n\n\n
    --nvdApiKey \"$NVD_API_KEY\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    What Dependency-Check is doing<\/h2>\n\n\n\n
    During the scan it broadly performs this sequence:<\/p>\n\n\n
    Read application files\n        \u2193\nIdentify dependencies\n        \u2193\nCollect evidence about components\n        \u2193\nMatch components to vulnerability intelligence\n        \u2193\nAssociate possible CVEs\n        \u2193\nGenerate the report\n<\/code><\/span><\/pre>\n\n\n
    Expected completion<\/h2>\n\n\n\n
    The output should eventually indicate that analysis completed and that a report was written.<\/p>\n\n\n\n
    Do not<\/strong> expect an identical number of vulnerabilities every time. Vulnerability intelligence can change independently of the pinned application source code.<\/p>\n\n\n\n
    \n\n\n\n
    10. Locate the HTML Report<\/h1>\n\n\n\n
    List the output directory:<\/p>\n\n\n
    ls -lh ~\/odc-lab\/<\/span>reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    You should see:<\/p>\n\n\n
    dependency-check-report<\/span>.html<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    Open the report<\/h2>\n\n\n\n
    macOS<\/h3>\n\n\n
    open ~\/odc-lab\/<\/span>reports\/dependency-check-report.html\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Linux desktop<\/h3>\n\n\n
    xdg-open ~\/odc-lab\/<\/span>reports\/dependency-check-report.html\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    If a graphical browser is not available, copy the report to a workstation with a browser.<\/p>\n\n\n\n
    \n\n\n\n
    11. Read the HTML Report<\/h1>\n\n\n\n
    Spend several minutes examining one vulnerable dependency.<\/p>\n\n\n\n
    For one finding, identify these fields:<\/p>\n\n\n
    Dependency \/ component\n        \u2193\nDetected version\n        \u2193\nEvidence \/ identifiers\n        \u2193\nCVE\n        \u2193\nSeverity\n        \u2193\nCVSS score\n        \u2193\nVulnerability description\n        \u2193\nReferences\n        \u2193\nAffected-version information\n<\/code><\/span><\/pre>\n\n\n
    What the fields mean<\/h2>\n\n\n\n
    Field<\/th>Meaning<\/th><\/tr><\/thead>
    Dependency<\/td>The library or component being analyzed<\/td><\/tr>
    Version<\/td>Version Dependency-Check identified<\/td><\/tr>
    CVE<\/td>Public vulnerability identifier<\/td><\/tr>
    CVSS<\/td>Numerical severity score supplied by the vulnerability source<\/td><\/tr>
    Severity<\/td>Human-readable severity classification<\/td><\/tr>
    Evidence<\/td>Information used to identify the component<\/td><\/tr>
    CPE \/ identifiers<\/td>Component identity information used during matching where applicable<\/td><\/tr>
    Description<\/td>Summary of the vulnerability<\/td><\/tr>
    References<\/td>Vendor, advisory, NVD, patch, or other supporting links<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \n\n\n\n
    12. CVE and CVSS \u2014 5-Minute Explanation<\/h1>\n\n\n\n
    CVE<\/h2>\n\n\n\n
    CVE means Common Vulnerabilities and Exposures<\/strong>.<\/p>\n\n\n\n
    Example pattern:<\/p>\n\n\n
    CVE-YYYY-NNNNN\n<\/code><\/span><\/pre>\n\n\n
    A CVE identifies a publicly disclosed vulnerability. It does not by itself tell you whether your application is exploitable.<\/p>\n\n\n\n
    CVSS<\/h2>\n\n\n\n
    CVSS means Common Vulnerability Scoring System<\/strong>.<\/p>\n\n\n\n
    Typical interpretation:<\/p>\n\n\n\n
    CVSS score<\/th>Common severity label<\/th><\/tr><\/thead>
    0.0<\/td>None<\/td><\/tr>
    0.1\u20133.9<\/td>Low<\/td><\/tr>
    4.0\u20136.9<\/td>Medium<\/td><\/tr>
    7.0\u20138.9<\/td>High<\/td><\/tr>
    9.0\u201310.0<\/td>Critical<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    The score helps prioritize investigation, but it must be combined with application context.<\/p>\n\n\n\n
    \n\n\n\n
    13. Detection Is Not the Same as Confirmation<\/h1>\n\n\n\n
    Teach students this workflow:<\/p>\n\n\n
    Dependency-Check finding\n        \u2193\nIs the dependency really present?\n        \u2193\nIs the detected version correct?\n        \u2193\nDoes the CVE apply to that version?\n        \u2193\nDoes our application use the vulnerable functionality?\n        \u2193\nIs the component reachable\/exploitable in<\/span> our deployment?\n        \u2193\nUpgrade \/ mitigate \/ investigate \/ suppress with<\/span> justification\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Useful terms<\/h2>\n\n\n\n
    Detected vulnerability<\/h3>\n\n\n\n
    Dependency-Check found a relationship between a component and vulnerability intelligence.<\/p>\n\n\n\n
    Confirmed vulnerability<\/h3>\n\n\n\n
    Engineering\/security analysis confirms that the vulnerable component\/version and relevant conditions apply.<\/p>\n\n\n\n
    False positive<\/h3>\n\n\n\n
    The tool associated a vulnerability with the dependency incorrectly or the identification is not applicable.<\/p>\n\n\n\n
    Needs investigation<\/h3>\n\n\n\n
    The tool has provided enough evidence to justify review, but the team has not yet confirmed applicability or exploitability.<\/p>\n\n\n\n
    \n
    Never teach teams to suppress a finding simply because they do not want the pipeline to fail.<\/p>\n<\/blockquote>\n\n\n\n
    \n\n\n\n
    14. Generate a JSON Report<\/h1>\n\n\n\n
    Machine-readable output is useful for CI\/CD and security tooling.<\/p>\n\n\n\n
    Run:<\/p>\n\n\n
    ~\/odc-lab\/<\/span>dependency-check\/bin\/dependency-check.sh \\\n  --project \"OWASP NodeGoat Quick Lab\"<\/span> \\\n  --scan . \\\n  --data ~\/odc-lab\/<\/span>odc-data \\\n  --format JSON<\/span> \\\n  --out ~\/odc-lab\/<\/span>reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Check the directory:<\/p>\n\n\n
    ls -lh ~\/odc-lab\/<\/span>reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    You should now see a JSON report in addition to the HTML report.<\/p>\n\n\n\n
    Typical uses:<\/p>\n\n\n
    HTML  \u2192 Human review\nJSON<\/span>  \u2192 Automation \/ parsing \/ CI tools\nXML   \u2192 Integrations\nSARIF \u2192 Security\/code-scanning platforms that consume SARIF\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n\n
    15. Quick Security-Gate Demo<\/h1>\n\n\n\n
    Dependency-Check can return a failing exit status when findings meet or exceed a configured CVSS threshold.<\/p>\n\n\n\n
    For a demonstration threshold of 7.0<\/strong>:<\/p>\n\n\n
    ~\/odc-lab\/<\/span>dependency-check\/bin\/dependency-check.sh \\\n  --project \"OWASP NodeGoat Gate Demo\"<\/span> \\\n  --scan . \\\n  --data ~\/odc-lab\/<\/span>odc-data \\\n  --format HTML \\\n  --out ~\/odc-lab\/<\/span>reports \\\n  --failOnCVSS 7<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Immediately inspect the shell exit code:<\/p>\n\n\n
    echo<\/span> $?\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    Conceptually:<\/p>\n\n\n
    Scan\n \u2193\nFind vulnerabilities\n \u2193\nEvaluate CVSS scores\n \u2193\nCompare with<\/span> threshold\n \u2193\nReturn pass\/fail status\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Important distinction<\/h2>\n\n\n
    Report generation \u2260 vulnerability remediation\n\nSecurity gate \u2260 vulnerability proof\n\nBuild failure \u2260 application compromise\n<\/code><\/span><\/pre>\n\n\n
    A production threshold should be set by an organization’s risk policy, not copied blindly from this training example.<\/p>\n\n\n\n
    \n\n\n\n
    16. Where Dependency-Check Fits in CI\/CD<\/h1>\n\n\n\n
    A simple pipeline placement is:<\/p>\n\n\n
    Developer\n   \u2193\nGit push \/ Pull request\n   \u2193\nCI pipeline\n   \u2193\nRestore\/install dependencies\n   \u2193\nOWASP Dependency-Check\n   \u2193\nPublish security report\n   \u2193\nSecurity gate\n   \u2193\nBuild \/ Test \/ Deploy\n<\/code><\/span><\/pre>\n\n\n
    Typical automation pattern:<\/p>\n\n\n
    1.<\/span> Cache or centrally maintain Dependency-Check vulnerability data.\n2.<\/span> Scan the application during CI.\n3.<\/span> Save HTML\/JSON<\/span>\/SARIF as<\/span> artifacts.\n4.<\/span> Apply an agreed policy threshold.\n5.<\/span> Investigate findings.\n6.<\/span> Upgrade or mitigate vulnerable components.\n7.<\/span> Use documented suppressions only for<\/span> justified false<\/span> positives\/not-applicable findings.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n\n
    17. Essential CLI Options for This Lab<\/h1>\n\n\n\n
    Option<\/th>Purpose<\/th><\/tr><\/thead>
    --project<\/code><\/td>Sets the project name shown in the report<\/td><\/tr>
    --scan<\/code><\/td>Specifies the file\/directory to analyze<\/td><\/tr>
    --out<\/code><\/td>Specifies where reports are written<\/td><\/tr>
    --format<\/code><\/td>Selects report format<\/td><\/tr>
    --data<\/code><\/td>Specifies the Dependency-Check local data directory<\/td><\/tr>
    --nvdApiKey<\/code><\/td>Supplies an NVD API key for vulnerability-data updates<\/td><\/tr>
    --updateonly<\/code><\/td>Updates Dependency-Check data without running a project scan<\/td><\/tr>
    --failOnCVSS<\/code><\/td>Returns a failing status when the threshold is met\/exceeded<\/td><\/tr>
    --version<\/code><\/td>Displays the installed Dependency-Check version<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    For a quick lab, students do not<\/strong> need the full CLI option catalogue.<\/p>\n\n\n\n
    \n\n\n\n
    18. Three Student Tasks<\/h1>\n\n\n\n
    Task 1 \u2014 Verify and Scan<\/h2>\n\n\n\n
    Run:<\/p>\n\n\n
    ~\/odc-lab\/<\/span>dependency-check\/bin\/dependency-check.sh --version\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Then complete an HTML scan of NodeGoat.<\/p>\n\n\n\n
    Validation<\/h3>\n\n\n\n
    Student can show:<\/p>\n\n\n
    Dependency-Check<\/span> 13.0<\/span>.0<\/span>\nand<\/span>\ndependency-check-report<\/span>.html<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n\n
    Task 2 \u2014 Investigate One Finding<\/h2>\n\n\n\n
    Choose one dependency from the HTML report and record:<\/p>\n\n\n
    Dependency:\nVersion:\nCVE:\nCVSS:\nSeverity:\nWhat evidence identified the component?\nWhat should be investigated before calling it exploitable?\n<\/code><\/span><\/pre>\n\n\n
    Validation<\/h3>\n\n\n\n
    Student can explain why:<\/p>\n\n\n
    \"CVE detected\"<\/span> does not automatically mean \"application exploitable.\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n\n
    Task 3 \u2014 Demonstrate a Gate<\/h2>\n\n\n\n
    Run the scan with:<\/p>\n\n\n
    --failOnCVSS 7\n<\/code><\/span><\/pre>\n\n\n
    Then inspect:<\/p>\n\n\n
    echo<\/span> $?\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
    Validation<\/h3>\n\n\n\n
    Student can explain that the exit status can be consumed by a CI system as a security gate.<\/p>\n\n\n\n
    \n\n\n\n
    19. Quick Troubleshooting<\/h1>\n\n\n\n
    Problem \u2014 Java command not found<\/h2>\n\n\n\n
    Cause:<\/strong> Java is not installed or is not on PATH<\/code>.<\/p>\n\n\n\n
    Check:<\/strong><\/p>\n\n\n
    java -version\n<\/code><\/span><\/pre>\n\n\n
    Solution:<\/strong> Install a supported Java runtime. Java 17 is recommended for this lab.<\/p>\n\n\n\n
    \n\n\n\n
    Problem \u2014 dependency-check.sh<\/code> permission denied<\/h2>\n\n\n\n
    Check permissions:<\/p>\n\n\n
    ls -l ~\/odc-lab\/<\/span>dependency-check\/bin\/dependency-check.sh\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    If required:<\/p>\n\n\n
    chmod +x ~\/odc-lab\/<\/span>dependency-check\/bin\/dependency-check.sh\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    Verify:<\/p>\n\n\n
    ~\/odc-lab\/<\/span>dependency-check\/bin\/dependency-check.sh --version\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
    \n\n\n\n
    Problem \u2014 First scan is extremely slow<\/h2>\n\n\n\n
    Likely cause:<\/strong> Vulnerability data is being downloaded for the first time.<\/p>\n\n\n\n
    Best lab solution:<\/strong> Pre-populate and reuse the --data<\/code> directory before class.<\/p>\n\n\n\n
    \n\n\n\n
    Problem \u2014 NVD update errors or rate limiting<\/h2>\n\n\n\n
    Likely causes:<\/strong><\/p>\n\n\n\n
      \n
    • No NVD API key.<\/li>\n\n\n\n
    • API rate limiting.<\/li>\n\n\n\n
    • Proxy\/firewall restrictions.<\/li>\n\n\n\n
    • Temporary network issues.<\/li>\n<\/ul>\n\n\n\n
      Lab solution:<\/strong> Use the instructor-prepared Dependency-Check data directory rather than spending class time rebuilding it.<\/p>\n\n\n\n
      \n\n\n\n
      Problem \u2014 No report appears<\/h2>\n\n\n\n
      Confirm the requested output directory:<\/p>\n\n\n
      ls -lah ~\/odc-lab\/<\/span>reports\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Then confirm the scan path exists:<\/p>\n\n\n
      pwd<\/span>\nls<\/span> package<\/span>.json<\/span> package-lock<\/span>.json<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      Problem \u2014 Many findings appear<\/h2>\n\n\n\n
      That can be expected for a deliberately vulnerable training application.<\/p>\n\n\n\n
      Do not try to fix every finding during the 1-hour demo. Pick one finding and teach the investigation process.<\/p>\n\n\n\n
      \n\n\n\n
      20. Lab Validation Checklist<\/h1>\n\n\n\n
      At the end of the session, students should be able to check:<\/p>\n\n\n
      [ ] Java works\n[ ] Git works\n[ ] Dependency-Check 13.0<\/span>.0<\/span> is available\n[ ] NodeGoat is cloned\n[ ] Commit 9336e34<\/span> is checked out\n[ ] Dependency-Check data is available\n[ ] HTML scan completed\n[ ] HTML report opened\n[ ] One dependency was investigated\n[ ] One CVE was identified\n[ ] CVSS\/severity were interpreted\n[ ] JSON<\/span> output was demonstrated\n[ ] failOnCVSS security gate was demonstrated\n[ ] CI\/CD placement is understood\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      21. Five-Minute Knowledge Check<\/h1>\n\n\n\n
      1. What problem does Dependency-Check help solve?<\/h3>\n\n\n\n
      Answer:<\/strong> It helps identify known vulnerabilities associated with third-party software components used by an application.<\/p>\n\n\n\n
      2. Does a reported CVE automatically prove the application is exploitable?<\/h3>\n\n\n\n
      Answer:<\/strong> No. The finding must be validated in the context of the actual dependency, version, use, and deployment.<\/p>\n\n\n\n
      3. Why can the first Dependency-Check run take much longer?<\/h3>\n\n\n\n
      Answer:<\/strong> Dependency-Check may need to download and build\/update its local vulnerability data.<\/p>\n\n\n\n
      4. Which report is easiest for a person to review?<\/h3>\n\n\n\n
      Answer:<\/strong> HTML.<\/p>\n\n\n\n
      5. Why generate JSON or SARIF?<\/h3>\n\n\n\n
      Answer:<\/strong> They are machine-readable formats suitable for automation and security\/tool integrations.<\/p>\n\n\n\n
      6. What does --failOnCVSS 7<\/code> demonstrate?<\/h3>\n\n\n\n
      Answer:<\/strong> A CI\/security gate that returns a failing status when a finding reaches the configured CVSS threshold.<\/p>\n\n\n\n
      7. Should suppression be used to make an uncomfortable finding disappear?<\/h3>\n\n\n\n
      Answer:<\/strong> No. Suppression should be documented and justified for false positives or findings determined not to apply.<\/p>\n\n\n\n
      \n\n\n\n
      22. Key Takeaways<\/h1>\n\n\n
      1.<\/span> Dependency-Check is an SCA tool.\n\n2.<\/span> It analyzes application dependencies and matches them with<\/span> known vulnerability intelligence.\n\n3.<\/span> A finding is the beginning of<\/span> investigation\u2014not the end.\n\n4.<\/span> CVE identifies the vulnerability; CVSS helps communicate severity.\n\n5.<\/span> HTML is useful for<\/span> people; JSON<\/span>\/XML\/SARIF are useful for<\/span> automation and integrations.\n\n6.<\/span> Dependency-Check can participate in<\/span> a CI\/CD security gate using failOnCVSS.\n\n7.<\/span> Pre-populating the vulnerability database is essential for<\/span> a smooth 1<\/span>-hour classroom demo.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      23. Trainer Quick-Run Commands<\/h1>\n\n\n\n
      Use these commands for the live demo after the Dependency-Check data directory has been prepared.<\/p>\n\n\n
      <em<\/span>><\/span># 1. Verify Dependency-Check<\/em<\/span>><\/span>\n~\/odc-lab\/dependency-check\/bin\/dependency-check.sh --version\n\n<em<\/span>><\/span># 2. Clone and pin NodeGoat<\/em<\/span>><\/span>\ncd ~\/odc-lab\ngit clone https:\/\/github.com\/OWASP\/NodeGoat.git\ncd NodeGoat\ngit checkout 9336e34\n\n<em<\/span>><\/span># 3. HTML scan<\/em<\/span>><\/span>\nmkdir -p ~\/odc-lab\/reports\n~\/odc-lab\/dependency-check\/bin\/dependency-check.sh \\\n  --project \"OWASP NodeGoat Quick Lab\" \\\n  --scan . \\\n  --data ~\/odc-lab\/odc-data \\\n  --format HTML \\\n  --out ~\/odc-lab\/reports\n\n<em<\/span>><\/span># 4. Inspect output<\/em<\/span>><\/span>\nls -lh ~\/odc-lab\/reports\n\n<em<\/span>><\/span># 5. JSON scan<\/em<\/span>><\/span>\n~\/odc-lab\/dependency-check\/bin\/dependency-check.sh \\\n  --project \"OWASP NodeGoat Quick Lab\" \\\n  --scan . \\\n  --data ~\/odc-lab\/odc-data \\\n  --format JSON \\\n  --out ~\/odc-lab\/reports\n\n<em<\/span>><\/span># 6. Security-gate demo<\/em<\/span>><\/span>\n~\/odc-lab\/dependency-check\/bin\/dependency-check.sh \\\n  --project \"OWASP NodeGoat Gate Demo\" \\\n  --scan . \\\n  --data ~\/odc-lab\/odc-data \\\n  --format HTML \\\n  --out ~\/odc-lab\/reports \\\n  --failOnCVSS 7\n\necho $?\n<\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      24. Trainer Notes<\/h1>\n\n\n\n
      For a successful one-hour delivery:<\/p>\n\n\n\n
        \n
      • Prepare the Dependency-Check vulnerability data\u00a0before<\/strong>\u00a0students arrive.<\/li>\n\n\n\n
      • Do not spend classroom time troubleshooting NVD downloads unless update troubleshooting is the lesson.<\/li>\n\n\n\n
      • Demonstrate only one or two findings in depth.<\/li>\n\n\n\n
      • Emphasize evidence and investigation rather than vulnerability counts.<\/li>\n\n\n\n
      • Avoid turning the session into a complete SCA governance course.<\/li>\n\n\n\n
      • Use the CVSS threshold only to explain how a gate works; do not present\u00a07.0<\/code>\u00a0as a universal production policy.<\/li>\n\n\n\n
      • End by showing where the scan would run in CI\/CD rather than configuring a full pipeline during the hour.<\/li>\n<\/ul>\n\n\n\n
        \n\n\n\n
        25. Official References<\/h1>\n\n\n\n
        Use these source categories when expanding the lab:<\/p>\n\n\n\n
          \n
        • OWASP Dependency-Check documentation<\/li>\n\n\n\n
        • Dependency-Check official GitHub repository and releases<\/li>\n\n\n\n
        • NVD API documentation<\/li>\n\n\n\n
        • OWASP NodeGoat repository<\/li>\n\n\n\n
        • Official CI platform documentation when implementing pipeline integration<\/li>\n<\/ul>\n\n\n\n
          For instructor-led delivery, verify the Dependency-Check release and upstream documentation again before reusing this lab in a future semester or training cycle.<\/p>\n","protected":false},"excerpt":{"rendered":"
          Level: Beginner \/ Basic DevSecOpsDuration: 60 minutesFormat: Instructor-led hands-on demoFocus: Install \u2192 scan a real project \u2192 read findings \u2192 understand CVE\/CVSS \u2192 generate reports \u2192 demonstrate a simple security gate… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-78842","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78842","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=78842"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78842\/revisions"}],"predecessor-version":[{"id":78843,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/78842\/revisions\/78843"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=78842"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=78842"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=78842"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}