Question

我正在尝试将OWASP ZAP设置为使用提供的docker映像在本地运行。

docker run --name zap -u zap \
-p 8090:8090 -v "$(pwd)/reports":/zap/reports/:rw \
-i owasp/zap2docker-stable zap.sh -daemon -port 8090 -host 0.0.0.0 \
-config api.addrs.addr.name=.* -config api.addrs.addr.regex=true \
-config api.disablekey=true

如果我尝试运行快速扫描，它将成功完成

docker exec zap zap-cli --verbose quick-scan --self-contained --start-options '-config api.disablekey=true' http://www.itsecgames.com -l Medium

但是每次尝试进行主动扫描时，我都会不断得到Connection refused

docker exec zap zap-cli --verbose active-scan http://www.itsecgames.com

知道为什么会这样吗？

尝试生成报告时出现相同的错误：

docker exec zap zap-cli --verbose report -o /zap/reports/owasp-quick-scan-report.html --output-format html

编辑：并且日志没有显示任何有用的信息：

9864 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | TestPersistentXSSAttack in 0.003s with 0 message(s) sent and 0 alert(s) raised.
9864 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | TestSQLInjection strength MEDIUM threshold MEDIUM
10350 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | TestSQLInjection in 0.486s with 22 message(s) sent and 0 alert(s) raised.
10350 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | CodeInjectionPlugin strength MEDIUM threshold MEDIUM
10522 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | CodeInjectionPlugin in 0.172s with 8 message(s) sent and 0 alert(s) raised.
10522 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | CommandInjectionPlugin strength MEDIUM threshold MEDIUM
11355 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | CommandInjectionPlugin in 0.833s with 32 message(s) sent and 0 alert(s) raised.
11355 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | TestDirectoryBrowsing strength MEDIUM threshold MEDIUM
11389 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | TestDirectoryBrowsing in 0.034s with 1 message(s) sent and 0 alert(s) raised.
11389 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | TestExternalRedirect strength MEDIUM threshold MEDIUM
11579 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | TestExternalRedirect in 0.19s with 9 message(s) sent and 0 alert(s) raised.
11580 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | BufferOverflow strength MEDIUM threshold MEDIUM
11617 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | BufferOverflow in 0.037s with 1 message(s) sent and 0 alert(s) raised.
11617 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | FormatString strength MEDIUM threshold MEDIUM
11729 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | FormatString in 0.112s with 3 message(s) sent and 0 alert(s) raised.
11729 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | TestInjectionCRLF strength MEDIUM threshold MEDIUM
11911 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | TestInjectionCRLF in 0.182s with 7 message(s) sent and 0 alert(s) raised.
11912 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | TestParameterTamper strength MEDIUM threshold MEDIUM
12106 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host/plugin http://www.itsecgames.com | TestParameterTamper in 0.194s with 7 message(s) sent and 0 alert(s) raised.
12106 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - start host http://www.itsecgames.com | ScriptsActiveScanner strength MEDIUM threshold MEDIUM
12107 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - skipped plugin [no scripts enabled] http://www.itsecgames.com | ScriptsActiveScanner in 0.001s with 0 message(s) sent and 0 alert(s) raised.
12107 [Thread-9] INFO org.parosproxy.paros.core.scanner.HostProcess  - completed host http://www.itsecgames.com in 6.389s
12108 [Thread-8] INFO org.parosproxy.paros.core.scanner.Scanner  - scanner completed in 6.402s
16868 [Thread-27] INFO org.parosproxy.paros.core.scanner.Scanner  - scanner stopped
16887 [Thread-27] INFO hsqldb.db..ENGINE  - dataFileCache commit start
16891 [Thread-27] INFO hsqldb.db..ENGINE  - dataFileCache commit end
16895 [Thread-27] INFO hsqldb.db..ENGINE  - Database closed
16996 [Thread-27] INFO org.zaproxy.zap.extension.api.CoreAPI  - OWASP ZAP 2.7.0 terminated.

Answer 1

我自己被这个问题纠缠了。我不确定这是否也发生在您身上，但是经历了Python错误，我看到zap-cli试图通过端口8080而不是8090连接到代理。这就是我所有工作的方式：

我通过将端口更改为8080来启动ZAP守护程序。

docker run --rm -u zap -p 8090:8080 -d owasp/zap2docker-stable zap.sh -daemon -port 8080 -host 0.0.0.0 -config api.disablekey=true

冉open-url

docker exec <CONTAINER NAME/ID> zap-cli open-url <TARGET>

最后，我进行了扫描

docker exec <CONTAINER NAME/ID> zap-cli active-scan <TARGET>

OWASP ZAP泊坞窗在运行主动扫描时返回``连接被拒绝''

1 个答案: