0

I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code:

private static final String ZAP_ADDRESS = "localhost";
private static final int ZAP_PORT = 8090;
private static final String ZAP_API_KEY =
        null; // Change this if you have set the apikey in ZAP via Options / API

private static final String TARGET = "http://localhost:8080/examples/jsp/jsp2/el/basic-arithmetic.jsp";

public static void main(String[] args) {
    ClientApi api = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

    try {
         //*********** SPIDER *******************
        System.out.println("Spider : " + TARGET);


        //Probamos OPCIONES del spider
        String maxChildren="0";//Limite de hijos a explorar por nodo (0 es sin limite)
        String recurse="true";//Recursividad (boolean)
        String contextName=null;//nombre del contexto
        String subtreeOnly="false";//Para restringir el escaneo al subarbol de la url especificada (boolean)


        api.spider.setOptionMaxDepth(5);//Profundidad máxima para realizar el rastreo
        api.spider.setOptionMaxDuration(0);//Tiempo maximo del escaneo, 0 es hasta que explore todo
        api.spider.setOptionMaxParseSizeBytes(2621440); // Tamaño maximo  en bytes de las respuestas a analizar
        api.spider.setOptionSendRefererHeader(true);//si las consultas del spider han de incluir el ‘Referer’ header. 
        api.spider.setOptionAcceptCookies(true);//Si aceptamos o no cookies durante el spider
        api.spider.setOptionProcessForm(true);//Si se deben procesar los forms encontrados
        api.spider.setOptionPostForm(true);//Si los form que usen POST se procesan
        api.spider.setOptionParseComments(true);//Si se procesaran los comentarios html buscando enlaces a recursos
        api.spider.setOptionParseRobotsTxt(true);//Si se procesan los archivos robots.txt que se encuentren buscando enlaces a recursos
        api.spider.setOptionParseSitemapXml(true);//Si se procesa el siteMap.xml
        api.spider.setOptionParseSVNEntries(false);//Si se procesa metadata de SVN
        api.spider.setOptionParseGit(false);//Si se procesa metadata de Git
        api.spider.setOptionHandleODataParametersVisited(false);//Indica si se deben detectar parametros de OData


        ApiResponse resp = api.spider.scan(TARGET, maxChildren, recurse, contextName, subtreeOnly);



        // The scan now returns a scan id to support concurrent scanning
        String scanid = ((ApiResponseElement) resp).getValue();

        // Poll the status until it completes
        int progress;
        while (true) {
            progress =
                    Integer.parseInt(
                            ((ApiResponseElement) api.spider.status(scanid)).getValue());
            System.out.println("Spider progress : " + progress + "%");
            if (progress >= 100) {
                break;
            }
            Thread.sleep(1000);
        }
        System.out.println("Analisis Spider completo");

        //*********** ASCAN *******************

        System.out.println("Active scan : " + TARGET);

        //Probamos OPCIONES del Active Scan
          recurse="true";//Recursividad (boolean)
          String inScopeOnly="false";//se puede usar para restringir el escaneo a las URL que están en el alcance 
          String scanPolicyName=null;//permite especificar la política de exploración (si no se proporciona ninguna, usa la política de exploración predeterminada)
          String method=null;//
          String postData="true";//Si usa datos POST

          api.ascan.setOptionScanHeadersAllRequests(false);//Si se activa escanea las cabeceras de todas las peticiones, no solo las que envían parámetros.
          api.
          api.ascan.excludeFromScan("1234abc");//Expresion regular que indica los que se va ignorar en el escaneo

          resp = api.ascan.scan(TARGET, recurse, inScopeOnly, scanPolicyName, method, postData);

          // The scan now returns a scan id to support concurrent scanning
          scanid = ((ApiResponseElement) resp).getValue();
          // Poll the status until it completes
          while (true) {

              progress =
                      Integer.parseInt(
                              ((ApiResponseElement) api.ascan.status(scanid)).getValue());
              System.out.println("Active Scan progress : " + progress + "%");
              if (progress >= 100) {
                  break;
              }
              Thread.sleep(1000);
          }
          System.out.println("Active Scan complete");


        //GUARDO EL RESULTADO Conjunto
        //HTML
         System.out.println("Creando REPORT...");
         File archivo = new File("./REPORT.html");
         BufferedWriter bw = new BufferedWriter(new FileWriter(archivo));
         bw.write(new String(api.core.htmlreport()));
         bw.close();
         System.out.println("Resultado del SPIDER Y ASCAN guardado en REPORT.html");

         //JSON
         archivo = new File("./REPORT.json");
         bw = new BufferedWriter(new FileWriter(archivo));
         bw.write(new String(api.core.jsonreport()));
         bw.close();
         System.out.println("Resultado del SPIDER Y ASCAN guardado en REPORT.json");



    } catch (Exception e) {
        System.out.println("Exception : " + e.getMessage());
        e.printStackTrace();
    }
}

This code performs an active scan over a site with custom configuration. I have set several options for the Spider scan, but I could not the Active Input Vector Options for the active scan. How could I do that?

0

For the record this was answered in a ZAP User Group thread: https://groups.google.com/forum/#!topic/zaproxy-users/x6lpQ92kjkY and on StackOverflow: https://stackoverflow.com/questions/52309066/how-to-configure-active-scan-input-vectors-in-zap


The solution is not straight forward but here goes:

If you look at the defaults (or current values) via the optionTargetParamsInjectable and optionTargetParamsEnabledRPC end points, you'll see two integer values such as: 11 and 39 respectively.

Looking at https://github.com/zaproxy/zaproxy/blob/b48deb898066d2e8d23f567b58758daf3eed3be1/src/org/parosproxy/paros/core/scanner/ScannerParam.java#L105-L123

We can make sense of this:
1+2+8 = 11
1+2+4+32 = 39 [Multipart (1), XML (2), JSON (4), and DWR (32) is 39.]

ZAP Code & Active Scan Input Options Screenshot

So for the API endpoints:

  • setOptionTargetParamsEnabledRPC (Integer* )
  • setOptionTargetParamsInjectable (Integer* )

Calculate the value and pass it to the API....

Edit: Note there are now (as of zap 2.8) two additional API calls that allow you to control whether or not a query param should be inserted on GET requests that do not already have a parameter: ascan.api.action.setOptionAddQueryParamand ascan.api.view.optionAddQueryParam The associated Help info is here: https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsAscaninput#add-url-query-parameter

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.