Im trying to set up OWASP ZAP to work with my selenium tests.
public class ZapScanTest {
static Logger log = Logger.getLogger(ZapScanTest.class.getName());
private final static String ZAP_PROXYHOST = "127.0.0.1";
private final static int ZAP_PROXYPORT = 8080;
private final static String ZAP_APIKEY = null;
// Change this to the appropriate driver for the OS, alternatives in the drivers directory
private final static String CHROME_DRIVER_PATH = "drivers/chromedriver.exe";
private final static String MEDIUM = "MEDIUM";
private final static String HIGH = "HIGH";
private ScanningProxy zapScanner;
private Spider zapSpider;
private WebDriver driver;
private Login login;
private final static String[] policyNames = {"directory-browsing","cross-site-scripting","sql-injection","path-traversal","remote-file-inclusion","server-side-include",
"script-active-scan-rules","server-side-code-injection","external-redirect","crlf-injection"};
int currentScanID;
@Before
public void setup() {
zapScanner = new ZAProxyScanner(ZAP_PROXYHOST,ZAP_PROXYPORT,ZAP_APIKEY);
zapScanner.clear(); //Start a new session
zapSpider = (Spider)zapScanner;
log.info("Created client to ZAP API");
driver = DriverFactory.createProxyDriver("chrome",createZapProxyConfigurationForWebDriver(), CHROME_DRIVER_PATH);
myApp = new MyAppNavigation(driver);
myApp.registerUser(); //Doesn't matter if user already exists, bodgeit just throws an error
}
@After
public void after() {
driver.quit();
}
@Test
public void testSecurityVulnerabilitiesLogin() {
login.navigateToLogin();
log.info("Spidering...");
spiderWithZap();
login.navigateToLogin();
setAlertAndAttackStrength();
zapScanner.setEnablePassiveScan(true);
scanWithZap();
List<Alert> alerts = filterAlerts(zapScanner.getAlerts());
logAlerts(alerts);
assertThat(alerts.size(), equalTo(0));
}
However i keep getting the eorror: org.zaproxy.clientapi.core.ClientApiException: java.net.ConnectException: Connection refused: connect
Anybody got any help in how to set up one of these as im having real trouble getting it to run on my website on my device
Aucun commentaire:
Enregistrer un commentaire