@@ -9,18 +9,47 @@ These detect potential vulnerabilities by actively attacking the target, run as
99// Note that new active scripts will initially be disabled
1010// Right click the script in the Scripts tree and select "enable"
1111
12+ const ScanRuleMetadata = Java .type (" org.zaproxy.addon.commonlib.scanrules.ScanRuleMetadata"
13+
14+ function getMetadata () {
15+ return ScanRuleMetadata .fromYaml (`
16+ id: 12345
17+ name: Active Vulnerability Title
18+ description: Full description
19+ solution: The solution
20+ references:
21+ - https://www.example.org/reference1
22+ - https://www.example.org/reference2
23+ category: INJECTION # info_gather, browser, server, misc, injection
24+ risk: INFO # info, low, medium, high
25+ confidence: LOW # false_positive, low, medium, high, user_confirmed
26+ cweId: 0
27+ wascId: 0
28+ alertTags:
29+ name1: value1
30+ name2: value2
31+ otherInfo: Any other Info
32+ status: alpha
33+ alertRefOverrides:
34+ 12345-1: {}
35+ 12345-2:
36+ name: Active Vulnerability - Type XYZ
37+ description: Overridden description
38+ `
39+ }
40+
1241/**
1342 * Scans a "node", i.e. an individual entry in the Sites Tree.
1443 * The scanNode function will typically be called once for every page.
1544 *
1645 * @param as - the ActiveScan parent object that will do all the core interface tasks
1746 * (i.e.: sending and receiving messages, providing access to Strength and Threshold settings,
18- * raising alerts, etc.). This is an ScriptsActiveScanner object.
47+ * raising alerts, etc.). This is an ActiveScriptHelper object.
1948 * @param msg - the HTTP Message being scanned. This is an HttpMessage object.
2049 */
2150function scanNode (as , msg ) {
22- // Debugging can be done using println like this
23- print (' scan called for url=' + msg .getRequestHeader ().getURI ().toString ());
51+ // Debugging can be done using print like this
52+ print (' scanNode called for url=' + msg .getRequestHeader ().getURI ().toString ());
2453
2554 // Copy requests before reusing them
2655 msg = msg .cloneRequest ();
@@ -49,19 +78,33 @@ function scanNode(as, msg) {
4978 }
5079}
5180
81+ /**
82+ * Scans a host.
83+ * The scanHost function will be called once per host being scanned.
84+ * @param as - the ActiveScan parent object that will do all the core interface tasks
85+ * (i.e.: sending and receiving messages, providing access to Strength and Threshold settings,
86+ * raising alerts, etc.). This is an ActiveScriptHelper object.
87+ * @param msg - the HTTP Message being scanned. This is an HttpMessage object.
88+ */
89+ function scanHost (as , msg ) {
90+ // Debugging can be done using print like this
91+ const uri = msg .getRequestHeader ().getURI ();
92+ print (` scanHost called for host=${ uri .getHost ()} ` + (uri .getPort () !== - 1 ? ` :${ uri .getPort ()} ` : " "
93+ }
94+
5295/**
5396 * Scans a specific parameter in an HTTP message.
5497 * The scan function will typically be called for every parameter in every URL and Form for every page.
5598 *
5699 * @param as - the ActiveScan parent object that will do all the core interface tasks
57100 * (i.e.: sending and receiving messages, providing access to Strength and Threshold settings,
58- * raising alerts, etc.). This is an ScriptsActiveScanner object.
101+ * raising alerts, etc.). This is an ActiveScriptHelper object.
59102 * @param msg - the HTTP Message being scanned. This is an HttpMessage object.
60103 * @param {string} param - the name of the parameter being manipulated for this test/scan.
61104 * @param {string} value - the original parameter value.
62105 */
63106function scan (as , msg , param , value ) {
64- // Debugging can be done using println like this
107+ // Debugging can be done using print like this
65108 print (' scan called for url=' + msg .getRequestHeader ().getURI ().toString () +
66109 ' param=' + param + ' value=' + value);
67110
@@ -76,21 +119,11 @@ function scan(as, msg, param, value) {
76119
77120 // Test the response here, and make other requests as required
78121 if (true ) { // Change to a test which detects the vulnerability
79- // risk: 0: info, 1: low, 2: medium, 3: high
80- // confidence: 0: falsePositive, 1: low, 2: medium, 3: high, 4: confirmed
81- as .newAlert ()
82- .setRisk (1 )
83- .setConfidence (1 )
84- .setName (' Active Vulnerability title'
85- .setDescription (' Full description'
122+ // Call newAlert() if you're not using alertRefOverrides
123+ as .newAlert (" 12345-1"
86124 .setParam (param)
87125 .setAttack (' Your attack'
88126 .setEvidence (' Evidence'
89- .setOtherInfo (' Any other info'
90- .setSolution (' The solution'
91- .setReference (' References'
92- .setCweId (0 )
93- .setWascId (0 )
94127 .setMessage (msg)
95128 .raise ();
96129 }
@@ -111,8 +144,3 @@ function scan(as, msg, param, value) {
111144* Jruby : [ Active default template.rb] ( https://github.com/zaproxy/zap-extensions/blob/main/addOns/jruby/src/main/zapHomeFiles/scripts/templates/active/Active%20default%20template.rb )
112145* Jython : [ Active default template.py] ( https://github.com/zaproxy/zap-extensions/blob/main/addOns/jython/src/main/zapHomeFiles/scripts/templates/active/Active%20default%20template.py )
113146* Zest : [ Active default template.zst] ( https://github.com/zaproxy/zap-extensions/blob/main/addOns/zest/src/main/zapHomeFiles/scripts/templates/active/Active%20default%20template.zst )
114-
115-
116- ## Official Videos
117-
118- [ ZAP In Ten: Active Scan Scripts] ( https://play.sonatype.com/watch/aEwqErXFMTYdDDQbTgnJeA ) (11:38)
0 commit comments