使用 docker 镜像时，zapproxy 全扫描未运行提供的脚本

如何解决使用 docker 镜像时，zapproxy 全扫描未运行提供的脚本

我想在 zap 全面扫描期间针对每个请求启动一个 httpsender 脚本。 所以我做到了

docker run -v $(pwd):/zap/wrk/:rw -h -t owasp/zap2docker-weekly zap-full-scan.py -t https://www.test.com -z "-config script.scripts.name=http_parameters -config script.scripts.engine=ECMAScript -config script.scripts.type=httpsender -config script.scripts.enabled=true -config script.scripts.file=/zap/wrk/http_parameters.js"

我的 http_paramerters.js 是

var URL_TYPE    = org.parosproxy.paros.network.HtmlParameter.Type.url;
var HtmlParameter = Java.type('org.parosproxy.paros.network.HtmlParameter');

var paramName = 'test';
var paramValue = '123';

function sendingRequest(msg,initiator,helper) {
  print(' test')

  if (!msg.getRequestHeader().getURI().toString().contains(paramName + '=' + paramValue)) {
    //You might want to add a check here for the proper domain or path as well..
    var urlParams = msg.getUrlParams();
    var newParam = new HtmlParameter(URL_TYPE,paramName,paramValue);
    urlParams.add(newParam); // you Could print this if you need to see what's up
    msg.setGetParams(urlParams);
  }
  return msg;
}

function responseReceived(msg,helper) {
  //nothing to do here
}
 

预期行为

我的脚本必须执行。

来自 zap.log 文件的错误

日志中没有错误，如下所示

20```
21-01-11 17:05:22,349 Could not find custom hooks file at /home/zap/.zap_hooks.py
2021-01-11 17:05:22,349 Trigger hook: cli_opts,args: 1
2021-01-11 17:05:22,350 Using port: 48793
2021-01-11 17:05:22,351 Trigger hook: start_zap,args: 2
2021-01-11 17:05:22,352 Starting ZAP
2021-01-11 17:05:22,352 Params: ['zap-x.sh','-daemon','-port','48793','-host','0.0.0.0','-config','database.recoverylog=false','api.disablekey=true','api.addrs.addr.name=.*','api.addrs.addr.regex=true','spider.maxDuration=0','-addonupdate','-addoninstall','pscanrulesBeta','ascanrulesBeta','pscanrulesAlpha','ascanrulesAlpha','script.scripts.name=http_parameters.js','script.scripts.engine=ECMAScript','script.scripts.type=httpsender','script.scripts.enabled=true','script.scripts.file=/zap/wrk/http_parameters.js']
2021-01-11 17:05:22,363 Starting new HTTP connection (1): localhost:48793
Jan 11,2021 5:05:27 PM java.util.prefs.FileSystemPreferences$1 run
INFO: Created user preferences directory.
2021-01-11 17:05:28,390 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:37,460 http://localhost:48793 "GET http://zap/JSON/core/view/version/ HTTP/1.1" 200 26
2021-01-11 17:05:37,462 ZAP Version D-2021-01-04
2021-01-11 17:05:37,462 Took 15 seconds
2021-01-11 17:05:37,462 Trigger hook: zap_started,args: 2
2021-01-11 17:05:37,463 Tune
2021-01-11 17:05:37,463 disable all tags
2021-01-11 17:05:37,466 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:37,471 http://localhost:48793 "GET http://zap/JSON/pscan/action/disableAllTags/?apikey= HTTP/1.1" 200 15
2021-01-11 17:05:37,471 Set max pscan alerts
2021-01-11 17:05:37,472 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:37,476 http://localhost:48793 "GET http://zap/JSON/pscan/action/setMaxAlertsPerRule/?maxAlerts=10&apikey= HTTP/1.1" 200 15
2021-01-11 17:05:37,477 Trigger hook: zap_tuned,args: 1
2021-01-11 17:05:37,478 Trigger hook: zap_access_target,481 Starting new HTTPS connection (1): test.com:443
2021-01-11 17:05:40,671 Trigger hook: zap_spider,args: 2
2021-01-11 17:05:40,674 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:40,681 http://localhost:48793 "GET http://zap/JSON/spider/action/scan/?apikey=&url=https%3A%2F%2Ftest.com HTTP/1.1" 200 12
2021-01-11 17:05:45,685 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:45,688 http://localhost:48793 "GET http://zap/JSON/spider/view/status/?scanId=0 HTTP/1.1" 200 15
2021-01-11 17:05:45,690 Starting new HTTP connection (1): localhost:48793
2021-01-11 17:05:45,691 http://localhost:48793 "GET http://zap/JSON/spider/view/status/?scanId=0 HTTP/1.1" 200 15
2021-01-11 17:05:45,692 Spider progress %: 73

解决方法

我遇到了同样的错误，在我的情况下，使用 zap-baseline.py 更改 zap-full-scan.py 足以解决问题