java - 无法使用 zap-java-api 执行 zap 蜘蛛扫描

问题描述

我正在尝试使用 zap-java-api 对目标 url 运行蜘蛛扫描。请找到我上网的以下代码。

import org.zaproxy.clientapi.core.ApiResponse;
import org.zaproxy.clientapi.core.ApiResponseElement;
import org.zaproxy.clientapi.core.ClientApi;

public class SimpleExample {

    private static final String ZAP_ADDRESS = "localhost";
    private static final int ZAP_PORT = 8500;
    private static final String ZAP_API_KEY =
            "q0tgadu0fperhi21q0870gc37"; // Change this if you have set the apikey in ZAP via Options / API

    private static final String TARGET = "https://demo.testfire.net/";

    public static void main(String[] args) {
        ClientApi api = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

        try {
            // Start spidering the target
            System.out.println("Spider : " + TARGET);
            // It's not necessary to pass the ZAP API key again, already set when creating the
            // ClientApi.
            ApiResponse resp = api.spider.scan(TARGET, null, null, null, null);
            String scanid;
            int progress;

            // The scan now returns a scan id to support concurrent scanning
            scanid = ((ApiResponseElement) resp).getValue();

            // Poll the status until it completes
            while (true) {
                Thread.sleep(1000);
                progress =
                        Integer.parseInt(
                                ((ApiResponseElement) api.spider.status(scanid)).getValue());
                System.out.println("Spider progress : " + progress + "%");
                if (progress >= 100) {
                    break;
                }
            }
            System.out.println("Spider complete");

            // Give the passive scanner a chance to complete
            Thread.sleep(2000);

            System.out.println("Active scan : " + TARGET);
            resp = api.ascan.scan(TARGET, "True", "False", null, null, null);

            // The scan now returns a scan id to support concurrent scanning
            scanid = ((ApiResponseElement) resp).getValue();

            // Poll the status until it completes
            while (true) {
                Thread.sleep(5000);
                progress =
                        Integer.parseInt(
                                ((ApiResponseElement) api.ascan.status(scanid)).getValue());
                System.out.println("Active Scan progress : " + progress + "%");
                if (progress >= 100) {
                    break;
                }
            }
            System.out.println("Active Scan complete");

            System.out.println("Alerts:");
            System.out.println(new String(api.core.xmlreport()));

        } catch (Exception e) {
            System.out.println("Exception : " + e.getMessage());
            e.printStackTrace();
        }
    }
}

我不断收到以下异常：

Spider : https://demo.testfire.net/
Exception : java.net.SocketException: Unexpected end of file from server
org.zaproxy.clientapi.core.ClientApiException: java.net.SocketException: Unexpected end of file from server
    at org.zaproxy.clientapi.core.ClientApi.callApiDom(ClientApi.java:350)
    at org.zaproxy.clientapi.core.ClientApi.callApi(ClientApi.java:331)
    at org.zaproxy.clientapi.gen.Spider.scan(Spider.java:239)
    at com_test.SimpleExample.main(SimpleExample.java:24)
Caused by: java.net.SocketException: Unexpected end of file from server
    at sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
    at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
    at sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
    at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at java.net.HttpURLConnection.getResponseCode(Unknown Source)
    at org.zaproxy.clientapi.core.ClientApi.getConnectionInputStream(ClientApi.java:361)
    at org.zaproxy.clientapi.core.ClientApi.callApiDom(ClientApi.java:348)
    ... 3 more

我不确定除了目标 url 之外还有什么可以在蜘蛛扫描中传递。因此将其作为空值传递。

ApiResponse resp = api.spider.scan(TARGET, null, null, null, null);

我要做的就是对目标 url 运行蜘蛛扫描并通过 zap-java-api 生成 html 和 xml 报告。任何关于此的工作示例都会非常有帮助。提前致谢。

标签： javazap

java - 无法使用 zap-java-api 执行 zap 蜘蛛扫描

问题描述

解决方案

推荐阅读