Question

我正在尝试设置OWASP ZAP以与我的硒测试一起使用。

public class ZapScanTest {
static Logger log = Logger.getLogger(ZapScanTest.class.getName());
private final static String ZAP_PROXYHOST = "127.0.0.1";
private final static int ZAP_PROXYPORT = 8080;
private final static String ZAP_APIKEY = null;

// Change this to the appropriate driver for the OS, alternatives in the drivers directory
private final static String CHROME_DRIVER_PATH = "drivers/chromedriver.exe";
private final static String MEDIUM = "MEDIUM";
private final static String HIGH = "HIGH";
private ScanningProxy zapScanner;
private Spider zapSpider;
private WebDriver driver;
private Login login;
private final static String[] policyNames = {"directory-browsing","cross-site-scripting","sql-injection","path-traversal","remote-file-inclusion","server-side-include",
        "script-active-scan-rules","server-side-code-injection","external-redirect","crlf-injection"};
int currentScanID;


@Before
public void setup() {
    zapScanner = new ZAProxyScanner(ZAP_PROXYHOST,ZAP_PROXYPORT,ZAP_APIKEY);
    zapScanner.clear(); //Start a new session
    zapSpider = (Spider)zapScanner;
    log.info("Created client to ZAP API");
    driver = DriverFactory.createProxyDriver("chrome",createZapProxyConfigurationForWebDriver(), CHROME_DRIVER_PATH);
    myApp = new MyAppNavigation(driver);
    myApp.registerUser(); //Doesn't matter if user already exists, bodgeit just throws an error
}

@After
public void after() {
    driver.quit();
}

@Test
public void testSecurityVulnerabilitiesLogin() {
    login.navigateToLogin();
    log.info("Spidering...");
    spiderWithZap();
    login.navigateToLogin();

    setAlertAndAttackStrength();
    zapScanner.setEnablePassiveScan(true);
    scanWithZap();

    List<Alert> alerts = filterAlerts(zapScanner.getAlerts());
    logAlerts(alerts);
    assertThat(alerts.size(), equalTo(0));
}

但是我一直都在抱怨： org.zaproxy.clientapi.core.ClientApiException：java.net.ConnectException：拒绝连接：connect

任何人都无法获得如何设置其中之一的帮助，因为我无法真正在我的设备上的网站上运行它

Answer 1

您是否已禁用ZAP中的API密钥？如果没有，您将无法连接。

您可以使用以下命令通过命令行设置ZAP API密钥：

-config api.key = change-me-9203935709

然后，您需要在上面的脚本中指定它。

如果这样做，则在zap.log文件中查找任何错误消息。

硒的ZAP设置

1 个答案: