无法使用zap-java-api执行zap spider扫描

Question

我正在尝试使用zap-java-api对目标url运行爬虫扫描。请找到我在网上得到的以下代码。

import org.zaproxy.clientapi.core.ApiResponse;
import org.zaproxy.clientapi.core.ApiResponseElement;
import org.zaproxy.clientapi.core.ClientApi;

public class SimpleExample {

    private static final String ZAP_ADDRESS = "localhost";
    private static final int ZAP_PORT = 8500;
    private static final String ZAP_API_KEY =
            "q0tgadu0fperhi21q0870gc37"; // Change this if you have set the apikey in ZAP via Options / API

    private static final String TARGET = "https://demo.testfire.net/";

    public static void main(String[] args) {
        ClientApi api = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

        try {
            // Start spidering the target
            System.out.println("Spider : " + TARGET);
            // It's not necessary to pass the ZAP API key again, already set when creating the
            // ClientApi.
            ApiResponse resp = api.spider.scan(TARGET, null, null, null, null);
            String scanid;
            int progress;

            // The scan now returns a scan id to support concurrent scanning
            scanid = ((ApiResponseElement) resp).getValue();

            // Poll the status until it completes
            while (true) {
                Thread.sleep(1000);
                progress =
                        Integer.parseInt(
                                ((ApiResponseElement) api.spider.status(scanid)).getValue());
                System.out.println("Spider progress : " + progress + "%");
                if (progress >= 100) {
                    break;
                }
            }
            System.out.println("Spider complete");

            // Give the passive scanner a chance to complete
            Thread.sleep(2000);

            System.out.println("Active scan : " + TARGET);
            resp = api.ascan.scan(TARGET, "True", "False", null, null, null);

            // The scan now returns a scan id to support concurrent scanning
            scanid = ((ApiResponseElement) resp).getValue();

            // Poll the status until it completes
            while (true) {
                Thread.sleep(5000);
                progress =
                        Integer.parseInt(
                                ((ApiResponseElement) api.ascan.status(scanid)).getValue());
                System.out.println("Active Scan progress : " + progress + "%");
                if (progress >= 100) {
                    break;
                }
            }
            System.out.println("Active Scan complete");

            System.out.println("Alerts:");
            System.out.println(new String(api.core.xmlreport()));

        } catch (Exception e) {
            System.out.println("Exception : " + e.getMessage());
            e.printStackTrace();
        }
    }
}

我一直收到下面的异常：

Spider : https://demo.testfire.net/
Exception : java.net.SocketException: Unexpected end of file from server
org.zaproxy.clientapi.core.ClientApiException: java.net.SocketException: Unexpected end of file from server
    at org.zaproxy.clientapi.core.ClientApi.callApiDom(ClientApi.java:350)
    at org.zaproxy.clientapi.core.ClientApi.callApi(ClientApi.java:331)
    at org.zaproxy.clientapi.gen.Spider.scan(Spider.java:239)
    at com_test.SimpleExample.main(SimpleExample.java:24)
Caused by: java.net.SocketException: Unexpected end of file from server
    at sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
    at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
    at sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
    at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at java.net.HttpURLConnection.getResponseCode(Unknown Source)
    at org.zaproxy.clientapi.core.ClientApi.getConnectionInputStream(ClientApi.java:361)
    at org.zaproxy.clientapi.core.ClientApi.callApiDom(ClientApi.java:348)
    ... 3 more

除了目标url，我不确定要在爬行器扫描中传递什么。因此将其作为null传递。

ApiResponse resp = api.spider.scan(TARGET, null, null, null, null);

我所要做的就是通过zap-java-api运行爬虫扫描目标url并生成html & xml报告。这方面的任何工作示例都会很有帮助。提前谢谢。

Answer 1

这表明ZAP已经阻止了你的API调用。在ZAP中是否启用了API？您是否使用了正确的API密钥？

您可以查看可能包含更多信息的zap.log文件：https://github.com/zaproxy/zaproxy/wiki/FAQlogging

Answer 2

此错误消息...

Exception : java.net.SocketException: Unexpected end of file from server
org.zaproxy.clientapi.core.ClientApiException: java.net.SocketException: Unexpected end of file from server
    at org.zaproxy.clientapi.core.ClientApi.callApiDom(ClientApi.java:350)

远程服务器虽然接受了连接，但关闭了连接而没有发送响应的...implies。

原因

此错误背后可能有许多原因，其中一些原因如下：

• 可能远程系统太忙，无法处理请求，因此丢弃connection.
• There可能是请求中缺少/无效的标头值，从而导致内部错误，并且服务器关闭连接，而不是正常发送错误响应。
  • 可能存在网络延迟，因此应用程序随机丢弃连接。

我在你的代码块中没有看到任何这样的问题。然而，我怀疑所有的API设置都没有正确启用。

解决方案

确保在zap工具(ZAP -> tool -> Options -> API )中启用了所有API设置：

​

​