Client Side Integration on ZAP

Client Side Integration - Automation Framework Support

Mon, 01 Jan 0001 00:00:00 +0000

Client Side Integration - Automation Framework Support

This add-on supports the Automation Framework.

Job: spiderClient

The spiderClient job allows you to run the Client Spider, which is designed to explore modern web apps more effectively.

Client Side Integration

Mon, 01 Jan 0001 00:00:00 +0000

Recording Client Side Scripts

The ZAP Browser extensions allow you to record all of the actions you take in the browser as a Zest script. They can be used to record things like authentication scripts or other complex interactions. Zest scripts can be replayed in ZAP, whether in the desktop or in automation.

Client Side Integration - Client Spider

Mon, 01 Jan 0001 00:00:00 +0000

Client Side Integration - Client Spider

This add-on adds a Client Spider which is designed to explore modern web apps more effectively.

The Client Spider works in a similar way to the AJAX Spider but it has access to the DOM via the ZAP Browser Extension which means that it can find content which the AJAX Spider cannot find.

Client Side Integration - Client Spider API

Mon, 01 Jan 0001 00:00:00 +0000

Client Side Integration - Client Spider API

This add-on adds various API endpoints to allow you to control the Client Spider programmatically.

The API is accessible via clientSpider API prefix.

Views

status (scanId*): Gets the status of the spider scan. Returns an integer between 0 and 100 indicating current progress.

Actions

scan (browser url contextName userName subtreeOnly maxCrawlDepth pageLoadTime numberOfBrowsers scopeCheck): Runs the Client Spider against the given URL and/or context. Returns the scanId.
stop (scanId*): Stops a Client Spider scan.

Parameters

browser: The browser to use for the scan, e.g. ‘firefox-headless’. If not specified, uses Firefox Headless.
url: The URL to start the scan at. If not specified and a context is set, the first URL in the context will be used.
contextName: The name of the context to scan.
userName: The name of the user to run the scan as. The user must exist in the specified context.
subtreeOnly: If set to ’true’, the spider will only scan URLs under the specified URL. Default: ‘false’.
maxCrawlDepth: The maximum depth the spider should crawl, where 0 is unlimited. Defaults to client options.
pageLoadTime: The time in seconds to wait for a page to load. Defaults to client options.
numberOfBrowsers: Number of Browser Windows to Open (concurrency). Integer, defaults to client options.
scopeCheck: Scope Check mode, either FLEXIBLE (default) or STRICT.
scanId: The ID of the scan to query or manage.

Examples

Start a scan:

https://zap/JSON/clientSpider/action/scan/?url=https://example.com&maxCrawlDepth=5&pageLoadTime=30&numberOfBrowsers=1&scopeCheck=STRICT

Check status:

https://zap/JSON/clientSpider/view/status/?scanId=1

Stop a scan:

https://zap/JSON/clientSpider/action/stop/?scanId=1

Client Side Integration - Passive Scan Rules

Mon, 01 Jan 0001 00:00:00 +0000

Client Side Integration - Passive Scan Rules

The Client Side Integration add-on supports passive scanning of the data streamed from the browser.

The following rules are included in this add-on:

Information Disclosure - Information in Browser Storage

This rule reports any information stored in browser localStorage and sessionStorage.

Client Side Integration - AJAX Spider Enhancement

Mon, 01 Jan 0001 00:00:00 +0000

Client Side Integration - AJAX Spider Enhancement

This add-on now adds a Client Spider which is designed to explore modern web apps more effectively. You are recommended to try this out as it is likely to be more effective that the AJAX Spider Enhancement detailed here.

Also note that from ZAP 2.16.0 the AJAX Spider has an option to enable browser extensions, and that option is turned off by default. You will need to turn it on in order for this integration to work.

Client Side Integration - Firefox Profile

Mon, 01 Jan 0001 00:00:00 +0000

Client Side Integration - Firefox Profile

This add-on creates a Firefox profile called ‘zap-client-profile’ and sets it as the default profile that ZAP will use. This profile enables the ZAP Firefox extension for all sites.

If you choose to use another profile then you will need to manually approve the ZAP extension for every site you use it for, every time you launch a browser from ZAP.

Client Side Integration - Internals

Mon, 01 Jan 0001 00:00:00 +0000

Client Side Integration - Internals

Browser Extension

This add-on depends on a ZAP browser extension which runs in Firefox and Chrome - if this extension is not present then this add-on will not be able to do anything.