owasp_zap 0.0.95 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 782c553bfa5aee80dc9987f306cff31a3cfe6b7e
-  data.tar.gz: 653a520ff07c6a14156cd84e43f33d6e814e81a0
+  metadata.gz: 6d6c84bf8558d7cf7a662388b75ddc327695dc9b
+  data.tar.gz: 8964c0d91f9b4d61c3a32d1c617e14602c0d6591
 SHA512:
-  metadata.gz: 73ff7b887bce019164c72b040c7b3549d1fb523b88390c9c1dc35b9976a4d5d9fa1d64aa2fe6f131f5e578acc31fe54d1ec8910f98ef083fd61d27c0b02f76f1
-  data.tar.gz: dc49d7f3e8e8f95408a722524b96a9c4e61159937f687ec0d0b0231a2c2dbfc66a7ee74b366ffc7156ffc0a961a5dc928a4ec0ae82684ef13cbebaeb6230bc09
+  metadata.gz: 7483f96f1e57554ffd017310af50bcf16f9fadaa8f638e1ac757462a0a05a1f4dbeb0e4618ea6a7c88b2a8d2a91cfc173afd2e8eb02767bca111a3379f660d54
+  data.tar.gz: 6612cade30f57e7dbf9d3b4c2d14600f36889109adc4ed132626ced4eb8836c9505f4cde75aa203539062a828aabe07bf0176cc30d46742cb8fe1dcdc7b7fe91

data/README.md

@@ -8,6 +8,8 @@ if you need a rpm, check it here: https://build.opensuse.org/package/show/home:v
 [![Build Status](https://travis-ci.org/vpereira/owasp_zap.png?branch=master)](https://travis-ci.org/vpereira/owasp_zap)
 [![Code Climate](https://codeclimate.com/github/vpereira/owasp_zap.png)](https://codeclimate.com/github/vpereira/owasp_zap)
 
+## Status: Maintained
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -25,18 +27,40 @@ Or install it yourself as:
 ## Usage
 
     require 'owasp_zap'
-    
-    include OwaspZap 
+
+    include OwaspZap
 
     z = Zap.new :target=>'http://xxx.xxx.xxx' # create new Zap instance with default params
     z = Zap.new :target=>'http://yyy.yyy.yyy', :zap=>"/usr/share/owasp-zap/zap.sh" # if you got my obs package
     z = Zap.new :output=>'logfile.txt' # it will log the stdout log from Zap Proxy to a file
     z.start # start interactive
     # TODO
-    # document it further :) 
+    # document it further :)
     z.start :daemon=>true # start in daemon mode
+    z.scan # to run active scan
+    z.alerts.view # you can specify one format JSON, XML or HTML.. default JSON.
     z.shutdown # stop the proxy
 
+    # to disable a specific test
+    to_be_disabled = JSON.load(z.policy.all)["policies"].select { |p| p["name"] == "Information gathering" }.first
+
+    unless to_be_disabled.nil?
+        z.scanner.disable([to_be_disabled["id"]])
+    end
+
+    # to print the XML report
+    z.xml_report
+
+## Important
+
+  Starting from version 2.4.1 ZAP creates an API key. Applications that call the
+  API wont be able to set anything without the API KEY. We must implement it.
+  Therefore to keep it working, as default we are disabling the api key.
+
+  Please check https://github.com/zaproxy/zaproxy/wiki/FAQapikey
+
+  and https://github.com/vpereira/owasp_zap/blob/master/lib/owasp_zap.rb#L88
+  
 ## Contributing
 
 1. Fork it

data/lib/owasp_zap.rb

@@ -19,12 +19,13 @@ module OwaspZap
 
     class Zap
        attr_accessor :target,:base, :zap_bin
-
+       attr_reader :api_key
        def initialize(params = {})
             #TODO
             # handle params
             @base = params[:base] || "http://127.0.0.1:8080"
             @target = params[:target]
+            @api_key = params[:api_key]
             @zap_bin = params [:zap] || "#{ENV['HOME']}/ZAP/zap.sh"
             @output = params[:output] || $stdout #default we log everything to the stdout
         end
@@ -62,7 +63,7 @@ module OwaspZap
         def alerts
             Zap::Alert.new(:base=>@base,:target=>@target)
         end
-        
+
         def scanner
             Zap::Scanner.new(:base=>@base)
         end
@@ -77,25 +78,42 @@ module OwaspZap
         end
 
         def auth
-            Zap::Auth.new(:base=>@base) 
+            Zap::Auth.new(:base=>@base)
         end
 
         # TODO
         # DOCUMENT the step necessary: install ZAP under $home/ZAP or should be passed to new as :zap parameter
         def start(params = {})
-            cmd_line = if params.key? :daemon
-                "#{@zap_bin} -daemon"
-            else
-                @zap_bin
+            # default we are disabling api key
+            params = {api_key:false}.merge(params)
+            cmd_line = "#{@zap_bin}"
+            case
+            when params.key?(:daemon)
+              cmd_line += " -daemon"
+            when params.key?(:api_key)
+              cmd_line += if params[:api_key] == true
+                " -config api.key=#{@api_key}"
+              else
+                " -config api.disablekey=true"
+              end
+            end
+            if params.key?(:host)
+                cmd_line += " -host #{params[:host]}"
+            end
+            if params.key?(:port)
+                cmd_line += " -port #{params[:port]}"
             end
             fork do
                # if you passed :output=>"file.txt" to the constructor, then it will send the forked process output
                # to this file (that means, ZAP stdout)
                unless @output == $stdout
                 STDOUT.reopen(File.open(@output, 'w+'))
-                STDOUT.sync = true 
+                STDOUT.sync = true
                end
+               print "Running the following command: #{cmd_line} \n"
+
                exec cmd_line
+
             end
         end
 
@@ -105,9 +123,13 @@ module OwaspZap
         end
 
         #xml report
-        #maybe it should be refactored to alert. 
+        #maybe it should be refactored to alert.
         def xml_report
             RestClient::get "#{@base}/OTHER/core/other/xmlreport/"
         end
+
+        def html_report
+            RestClient::get "#{@base}/OTHER/core/other/htmlreport/"
+        end
    end
 end

data/lib/owasp_zap/auth.rb

@@ -2,6 +2,7 @@ module OwaspZap
     class Auth
         attr_accessor :ctx,:base
         def initialize(params = {})
+            import_context(params[:context_name]) if !params[:context_name].nil?
             @ctx = params[:context] || 1 #default context is the1
             @base = params[:base] || "http://127.0.0.1:8080/JSON"
         end
@@ -31,6 +32,12 @@ module OwaspZap
         # url: url including http:// 
         # post_data: an already encoded string like "email%3Dfoo%2540example.org%26passwd%3Dfoobar" 
         # TODO: offer a way to encode it, giving a hash?
+        def import_context(context)
+          set_query "{@base}/context/action/importContext/",postData: context
+          contexts = RestClient::get "{@base}/context/view/contextList"
+          puts contexts
+        end
+
         def set_login_url(args)
             set_query "#{@base}/auth/action/setLoginUrl/",:postData=>args[:post_data]
         end

data/lib/owasp_zap/spider.rb

@@ -24,10 +24,21 @@ module OwaspZap
             if ret.has_key? "status"
                 ret["status"].to_i
             else
-                100 # it means no running
+                100 # it means not running
             end
        end
 
+       def set_depth(max_d)
+            #http://localhost:8084/JSON/spider/action/setOptionMaxDepth/?Integer=1
+            url = Addressable::URI.parse("#{@base}/JSON/spider/action/setOptionMaxDepth/")
+            url.query_values = {:integer=>max_d.to_i}
+            RestClient::get url.normalize.to_str
+       end
+
+       def depth
+            JSON.parse(RestClient::get("#{@base}/JSON/spider/view/optionMaxDepth/?zapapiformat=JSON"))
+       end
+
        def running?
             self.status != 100
        end

data/lib/owasp_zap/version.rb

@@ -1,3 +1,3 @@
 module OwaspZap
-  VERSION = "0.0.95"
+  VERSION = "0.1.0"
 end

data/spec/spider_spec.rb

@@ -0,0 +1,34 @@
+describe OwaspZap::Spider do
+    before do
+        @spider = OwaspZap::Spider.new :base=>"http://127.0.0.1:8080",:target=>"http://example.org"
+    end
+    it "should not be_nil" do
+        refute @spider.nil?
+    end
+    it "should respond_to running?" do
+        @spider.must_respond_to :running?
+    end
+    it "should be running if status != 100" do
+      @spider.stub(:status,95) do
+        @spider.running?.must_equal true
+      end
+    end
+
+    it "should not be running if status == 100" do
+      @spider.stub(:status,100) do
+        @spider.running?.must_equal false
+      end
+    end
+
+    it "should set depth" do
+      stub_request(:get, "http://127.0.0.1:8080/JSON/spider/action/setOptionMaxDepth/?integer=1").
+        to_return(:status => 200, :body => "{\"Result\":\"OK\"}", :headers => {})
+      @spider.set_depth(1).wont_be_nil
+    end
+
+    it "should get depth" do
+      stub_request(:get, "http://127.0.0.1:8080/JSON/spider/view/optionMaxDepth/?zapapiformat=JSON").
+        to_return(:status => 200, :body => "{\"MaxDepth\":\"2\"}", :headers => {})
+      @spider.depth.wont_be_nil
+    end
+end

metadata

@@ -1,111 +1,111 @@
 --- !ruby/object:Gem::Specification
 name: owasp_zap
 version: !ruby/object:Gem::Version
-  version: 0.0.95
+  version: 0.1.0
 platform: ruby
 authors:
 - Victor Pereira
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-08-07 00:00:00.000000000 Z
+date: 2018-03-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rest-client
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 description: ruby wrapper for ZAP
@@ -115,8 +115,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
-- .travis.yml
+- ".gitignore"
+- ".travis.yml"
 - Gemfile
 - LICENSE.txt
 - README.md
@@ -136,6 +136,7 @@ files:
 - spec/auth_spec.rb
 - spec/helper.rb
 - spec/scanner_spec.rb
+- spec/spider_spec.rb
 - spec/zap_spec.rb
 homepage: ''
 licenses:
@@ -147,17 +148,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.14
+rubygems_version: 2.6.14
 signing_key: 
 specification_version: 4
 summary: ruby wrapper for the zed application proxy
@@ -166,4 +167,5 @@ test_files:
 - spec/auth_spec.rb
 - spec/helper.rb
 - spec/scanner_spec.rb
+- spec/spider_spec.rb
 - spec/zap_spec.rb