1

I am currently working on a python script that will automate zap for me so I do not have to go in and manually fuzz the fields or crawl pages. The part I am stuck on is that my script currently can only crawl the web login main page. How do I go about getting it to login from my script and start crawling other pages on the web app?

I was testing the example script from the OWASP github repo:

#!/usr/bin/env python3


import time
from pprint import pprint
from zapv2 import ZAPv2

target = 'http://127.0.0.1' # Replace this with your target URL or IP
# Change to match the API key set in ZAP under tools menu, options, API tab. or use None if the API key is disabled.
apikey = 'Place your API KEY HERE'


class OwaspZap(object):

    def Api_Connect(self):
        zap = ZAPv2(apikey=apikey)
        print('[+]Accessing target {}'.format(target))
        zap.urlopen(target)
        time.sleep(2)

    def Spider_Crawl(self):
        zap = ZAPv2(apikey=apikey)
        print('Spidering target {}'.format(target))
        scanid = zap.spider.scan(target)
        # Give the Spider a chance to start
        time.sleep(2)
        while(int(zap.spider.status(scanid)) < 100):
            #This will loop until the spider has finished
            print('Spider progress %: {}'.format(zap.spider.status(scanid)))
            time.sleep(2)
        print('Spider crawl completed')

    def Passive_Scan(self):
        zap = ZAPv2(apikey=apikey)
        while(int(zap.pscan.records_to_scan) > 0):
            print('Records to passive scan : {}'.format(zap.pscan.records_to_scan))
            time.sleep(2)
        print('Passive Scan completed')

    def Active_Scan(self):
        zap = ZAPv2(apikey=apikey)
        print('Active Scanning target {}'.format(target))
        scanid = zap.ascan.scan(target)
        while(int(zap.ascan.status(scanid)) < 100):
                # Loop until the scanner has finished
            print('Scan progress %: {}'.format(zap.ascan.status(scanid)))
            time.sleep(5)
        print('Active Scan completed')

    def Show_Results(self):
        zap = ZAPv2(apikey=apikey)
        # Reports the results
        print('Hosts: {}'.format(', '.join(zap.core.hosts)))
        print('Alerts: ')
        pprint(zap.core.alerts())


zapp = OwaspZap()
zapp.Api_Connect()
zapp.Spider_Crawl()
zapp.Passive_Scan()
zapp.Active_Scan()
zapp.Show_Results()
1

It all depends on how your application authenticated users. ZAP can handle pretty much any type of authentication, but configuring it can be non trivial. We are actively working on improving this. Have a look at this tutorial video.
If your app uses a standard login form then see here.

I'd recommend getting authentication working with the ZAP desktop first (as this makes debugging much easier) and once thats working translating the same steps to your script.
For more help ask on the ZAP User Group.

  • Thank you :) Also, Is there a detailed documentation on how to use the Zap Python Library? I want to read up on what each module does if possible. – john_zombie Jul 13 '18 at 13:36
  • It maps directly onto the ZAP API - you can explore that by pointing your browser at the host:port ZAP is listening on. There are some descriptions but the best thing to do is to play with it ;) – Simon Bennetts Jul 13 '18 at 13:45
  • I watched the authentication video which was very helpful, but I am stuck trying to add this authentication in my python script. It would be a form based authentication type. How would I go about starting that In my script? Is it a module that I have to call? – john_zombie Jul 13 '18 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.