vendredi 22 février 2019

ZAP setup for selenium

Im trying to set up OWASP ZAP to work with my selenium tests.

public class ZapScanTest {
static Logger log = Logger.getLogger(ZapScanTest.class.getName());
private final static String ZAP_PROXYHOST = "127.0.0.1";
private final static int ZAP_PROXYPORT = 8080;
private final static String ZAP_APIKEY = null;

// Change this to the appropriate driver for the OS, alternatives in the drivers directory
private final static String CHROME_DRIVER_PATH = "drivers/chromedriver.exe";
private final static String MEDIUM = "MEDIUM";
private final static String HIGH = "HIGH";
private ScanningProxy zapScanner;
private Spider zapSpider;
private WebDriver driver;
private Login login;
private final static String[] policyNames = {"directory-browsing","cross-site-scripting","sql-injection","path-traversal","remote-file-inclusion","server-side-include",
        "script-active-scan-rules","server-side-code-injection","external-redirect","crlf-injection"};
int currentScanID;


@Before
public void setup() {
    zapScanner = new ZAProxyScanner(ZAP_PROXYHOST,ZAP_PROXYPORT,ZAP_APIKEY);
    zapScanner.clear(); //Start a new session
    zapSpider = (Spider)zapScanner;
    log.info("Created client to ZAP API");
    driver = DriverFactory.createProxyDriver("chrome",createZapProxyConfigurationForWebDriver(), CHROME_DRIVER_PATH);
    myApp = new MyAppNavigation(driver);
    myApp.registerUser(); //Doesn't matter if user already exists, bodgeit just throws an error
}

@After
public void after() {
    driver.quit();
}

@Test
public void testSecurityVulnerabilitiesLogin() {
    login.navigateToLogin();
    log.info("Spidering...");
    spiderWithZap();
    login.navigateToLogin();

    setAlertAndAttackStrength();
    zapScanner.setEnablePassiveScan(true);
    scanWithZap();

    List<Alert> alerts = filterAlerts(zapScanner.getAlerts());
    logAlerts(alerts);
    assertThat(alerts.size(), equalTo(0));
}

However i keep getting the eorror: org.zaproxy.clientapi.core.ClientApiException: java.net.ConnectException: Connection refused: connect

Anybody got any help in how to set up one of these as im having real trouble getting it to run on my website on my device

Aucun commentaire:

Enregistrer un commentaire