0

我想在 zap 完整扫描期间对每个请求启动一个 httpsender 脚本。所以我做了

docker run -v $(pwd):/zap/wrk/:rw -h -t owasp/zap2docker-weekly zap-full-scan.py -t https://www.test.com -z "-config script.scripts.name=http_parameters -config script.scripts.engine=ECMAScript -config script.scripts.type=httpsender -config script.scripts.enabled=true -config script.scripts.file=/zap/wrk/http_parameters.js"

我的 http_paramerters.js 是

var URL_TYPE    = org.parosproxy.paros.network.HtmlParameter.Type.url;
var HtmlParameter = Java.type('org.parosproxy.paros.network.HtmlParameter');

var paramName = 'test';
var paramValue = '123';

function sendingRequest(msg, initiator, helper) {
  print(' test')

  if (!msg.getRequestHeader().getURI().toString().contains(paramName + '=' + paramValue)) {
    //You might want to add a check here for the proper domain or path as well..
    var urlParams = msg.getUrlParams();
    var newParam = new HtmlParameter(URL_TYPE, paramName, paramValue);
    urlParams.add(newParam); // you could print this if you need to see what's up
    msg.setGetParams(urlParams);
  }
  return msg;
}

function responseReceived(msg, initiator, helper) {
  //Nothing to do here
}

预期行为

我的脚本必须被执行。

zap.log 文件中的错误

日志中没有错误，如下所示

20```
21-01-11 17:05:22,349 Could not find custom hooks file at /home/zap/.zap_hooks.py
2021-01-11 17:05:22,349 Trigger hook: cli_opts, args: 1
2021-01-11 17:05:22,350 Using port: 48793
2021-01-11 17:05:22,351 Trigger hook: start_zap, args: 2
2021-01-11 17:05:22,352 Starting ZAP
2021-01-11 17:05:22,352 Params: ['zap-x.sh', '-daemon', '-port', '48793', '-host', '0.0.0.0', '-config', 'database.recoverylog=false', '-config', 'api.disablekey=true', '-config', 'api.addrs.addr.name=.*', '-config', 'api.addrs.addr.regex=true', '-config', 'spider.maxDuration=0', '-addonupdate', '-addoninstall', 'pscanrulesBeta', '-addoninstall', 'ascanrulesBeta', '-addoninstall', 'pscanrulesAlpha', '-addoninstall', 'ascanrulesAlpha', '-config', 'script.scripts.name=http_parameters.js', '-config', 'script.scripts.engine=ECMAScript', '-config', 'script.scripts.type=httpsender', '-config', 'script.scripts.enabled=true', '-config', 'script.scripts.file=/zap/wrk/http_parameters.js']
2021-01-11 17:05:22,363 Starting new HTTP connection (1): localhost:48793
Jan 11, 2021 5:05:27 PM java.util.prefs.FileSystemPreferences$1 run
INFO: Created user preferences directory.
2021-01-11 17:05:28,390 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:37,460 http://localhost:48793 "GET http://zap/JSON/core/view/version/ HTTP/1.1" 200 26
2021-01-11 17:05:37,462 ZAP Version D-2021-01-04
2021-01-11 17:05:37,462 Took 15 seconds
2021-01-11 17:05:37,462 Trigger hook: zap_started, args: 2
2021-01-11 17:05:37,463 Tune
2021-01-11 17:05:37,463 Disable all tags
2021-01-11 17:05:37,466 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:37,471 http://localhost:48793 "GET http://zap/JSON/pscan/action/disableAllTags/?apikey= HTTP/1.1" 200 15
2021-01-11 17:05:37,471 Set max pscan alerts
2021-01-11 17:05:37,472 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:37,476 http://localhost:48793 "GET http://zap/JSON/pscan/action/setMaxAlertsPerRule/?maxAlerts=10&apikey= HTTP/1.1" 200 15
2021-01-11 17:05:37,477 Trigger hook: zap_tuned, args: 1
2021-01-11 17:05:37,478 Trigger hook: zap_access_target, args: 2
2021-01-11 17:05:37,481 Starting new HTTPS connection (1): test.com:443
2021-01-11 17:05:40,671 Trigger hook: zap_spider, args: 2
2021-01-11 17:05:40,674 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:40,681 http://localhost:48793 "GET http://zap/JSON/spider/action/scan/?apikey=&url=https%3A%2F%2Ftest.com HTTP/1.1" 200 12
2021-01-11 17:05:45,685 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:45,688 http://localhost:48793 "GET http://zap/JSON/spider/view/status/?scanId=0 HTTP/1.1" 200 15
2021-01-11 17:05:45,690 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:45,691 http://localhost:48793 "GET http://zap/JSON/spider/view/status/?scanId=0 HTTP/1.1" 200 15
2021-01-11 17:05:45,692 Spider progress %: 73
4

1 回答 1

0

我遇到了同样的错误，在我的情况下，用 zap-baseline.py 更改 zap-full-scan.py 足以解决问题

于 2021-06-27T06:28:19.843 回答