Replies: 1 comment
-
|
Hi 👋 Can recommend first trying and debugging ZAP Scripts first in the ZAP Ui. Debugging them in any automation setting like the secureCodeBox is a lot harder. If the script in the ZAP zu it should also work in the SCB. Also fyi the zap advanced scantype will be deprecated soon and be replaced with the official zap automation framework. See PR #3287 |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi all,
I'm trying to pentest our rest API by using zap-advanced. Based on the example "authentication script based", my script for the authentication should inject the bearer token. The issue is that the script does not start, but i'm getting a warning:
2024-06-13 09:42 ZapClient INFO : Loading new Script 'scb-oidc-password-grand-type.js' at '/home/scripts/scb-oidc-password-grand-type.js' with type: 'authentication' and engine 'Oracle Nashorn'
2024-06-13 09:42 ZapClient INFO : Activating Script 'scb-oidc-password-grand-type.js' with 'enabled: true'
2024-06-13 09:42 ZapClient WARNING : Failed to call ZAP Method ['script.enable'], result is: 'illegal_parameter'
my configuration looks like:
2-zap-advanced-scan.yaml: |- global: addonUpdate: true # -- Installs additional ZAP AddOns on startup, listed by their name: addonInstall: - pscanrulesBeta - ascanrulesBeta - pscanrulesAlpha - ascanrulesAlpha includePaths: - "https://xxxxxxxx.*" contexts: - name: pentest authentication: type: "script-based" script-based: name: scb-oidc-password-grand-type.js engine: "Oracle Nashorn" filePath: "/home/scripts/scb-oidc-password-grand-type.js" description: "This is a description for the SCB OIDC Script." arguments: url: "https://test/token" clientId: "xxxxxxxx" clientSecret: "yyyyyyy" users: - name: technical-user username: ******** password: ******** forced: truemy script:
`var HttpRequestHeader = Java.type("org.parosproxy.paros.network.HttpRequestHeader"),
HttpHeader = Java.type("org.parosproxy.paros.network.HttpHeader"),
URI = Java.type("org.apache.commons.httpclient.URI");
function authenticate(helper, paramsValues, credentials) {
print("Authentication via scb-oidc-password-grand-type.js...");
}
function getRequiredParamsNames() {
return ["url", "clientId","clientSecret"];
}
function getOptionalParamsNames() {
return [];
}
function getCredentialsParamsNames() {
return ["username", "password"];
}
`
Beta Was this translation helpful? Give feedback.
All reactions