0

我正在尝试将硒与 ZAP 集成。

为此，我使用以下代码在使用 selenium 启动浏览器之前自动打开 ZAP 工具。

我面临的问题是 ZAP 工具没有正确打开，它卡在了中间。

下面的代码我用来打开 ZAP 工具。

代码：

public void triggerZAP() throws IOException, InterruptedException, ClientApiException
{       
    String[] command = { "CMD", "/C",zapLocation + "ZAP.exe" };
    ProcessBuilder build = new ProcessBuilder(command);
    build.directory(new File(zapLocation));
    Process p = build.start();
    p.waitFor();
    Thread.sleep(5000);
    ClientApi api = new ClientApi(zapAddress, zapPort);
    currentURL = controls.getCurrentUrl();
    System.out.println("Spider : " + currentURL);
    ApiResponse resp = api.spider.scan(currentURL, null, null, null, null);
    scanId = ((ApiResponseElement) resp).getValue();
    while (true)
    {
        Thread.sleep(1000);
        progress = Integer.parseInt(((ApiResponseElement) api.spider.status(scanId)).getValue());
        System.out.println("Spider progress : " + progress + "%");
        if (progress >= 100)
        {
            break;
        }
    }
    System.out.println("Spider complete");
    System.out.println(new String(api.core.xmlreport()));

}

错误：

org.zaproxy.clientapi.core.ClientApiException: java.net.ConnectException: Connection refused: connect
at org.zaproxy.clientapi.core.ClientApi.callApiDom(ClientApi.java:329)
at org.zaproxy.clientapi.core.ClientApi.callApi(ClientApi.java:311)
at org.zaproxy.clientapi.gen.Spider.scan(Spider.java:220)
at com.exterro.fusion.selenium.controls.ZAPConfigurations.triggerZAP(ZAPConfigurations.java:61)
at com.exterro.fusion.selenium.core.FusionSignin.config(FusionSignin.java:54)
Caused by: java.net.ConnectException: Connection refused: connect
at java.net.DualStackPlainSocketImpl.connect0(Native Method)
at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.net.PlainSocketImpl.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at sun.net.NetworkClient.doConnect(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.http.HttpClient$1.run(Unknown Source)
at sun.net.www.http.HttpClient$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at sun.net.www.http.HttpClient.privilegedOpenServer(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.http.HttpClient.<init>(Unknown Source)
at sun.net.www.http.HttpClient.New(Unknown Source)
at sun.net.www.http.HttpClient.New(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.connect(Unknown Source)
at org.zaproxy.clientapi.core.ClientApi.getConnectionInputStream(ClientApi.java:338)
at org.zaproxy.clientapi.core.ClientApi.callApiDom(ClientApi.java:327)
... 31 more
... Removed 27 stack frames
4

2 回答 2

1

当您启动 ZAP 时，您似乎没有指定 API 密钥。如果是这种情况，那么 ZAP 将为您创建一个，但您不会知道它是什么，因此无法使用它，ZAP 将忽略您的 API 调用。

要通过命令行设置 API 密钥，请使用如下选项：-config api.key=change-me-9203935709

您还可以在安全的环境中禁用 API 密钥 - 更多详细信息：https ://github.com/zaproxy/zaproxy/wiki/FAQapikey

于 2017-12-20T10:06:29.440 回答
0

此错误消息...

org.zaproxy.clientapi.core.ClientApiException: java.net.ConnectException: Connection refused: connect
at org.zaproxy.clientapi.core.ClientApi.callApiDom(ClientApi.java:329)

...意味着Java 客户端无法启动与 代理的新连接。

由于多种原因，此错误可能会出现。解决此错误的几个检查点如下：

ZAP_API_enable

您可以在Unable to perform zap spider scan using zap-java-api中找到相关讨论

  • 当您启动Java 客户端连接时，您需要强制提及API 密钥，因为 ZAP 默认需要 API 密钥才能调用对 ZAP 进行更改的 API 操作。因此，默认情况下需要 API 密钥才能调用任何 API 操作。这是一项防止恶意网站调用 ZAP API 的安全功能。API 安全选项（包括 API 密钥）可以在API 选项屏幕中找到。

    • 代码块：

      private static final int ZAP_PORT = 8080;
private static final String ZAP_API_KEY = "abcdefghijklmnop123456789";
private static final String ZAP_ADDRESS = "localhost";
private static final String TARGET = "https://public-firing-range.appspot.com";

您可以在Scanning using OWASP Zap Api中找到相关讨论

于 2020-05-22T14:33:09.017 回答