Script Console on ZAP

Scripts Automation Framework Support

Mon, 01 Jan 0001 00:00:00 +0000

Scripts Automation Framework Support

This add-on supports the Automation Framework.

Job: script

The script job allows you to execute various actions with scripts:

Script Console Tab

Mon, 01 Jan 0001 00:00:00 +0000

Script Console Tab

The Scripts Console allows you to write scripts which run within ZAP.

It is made up of:

A toolbar
A text area (top) in which you can write your scripts
An output text area (bottom) for debug and error messages, with “print” statements.

To create a new script or to load or switch scripts see the The Scripts ’tree’ tab.

Script Console Options

Mon, 01 Jan 0001 00:00:00 +0000

Script Console Options

When the Script in the Console Changes on Disk

This setting allows you to configure the default behaviour when a script open in the Script Console changes on disk, for example if it was updated in another code editor. There are three options to choose from:

Script Scan Rules

Mon, 01 Jan 0001 00:00:00 +0000

Script Scan Rules

Active and Passive Scripts that implement the getMetadata function are treated as first-class scan rules by ZAP. An example implementation of this function in a script would look like:

function getMetadata() {
	return ScanRuleMetadata.fromYaml(`
id: 12345
name: Active Vulnerability Title
description: Full description
solution: The solution
references:
  - Reference 1
  - Reference 2
category: INJECTION  # info_gather, browser, server, misc, injection
risk: INFO  # info, low, medium, high
confidence: LOW  # false_positive, low, medium, high, user_confirmed
cweId: 0
wascId: 0
alertTags:
  name1: value1
  name2: value2
otherInfo: Any other Info
status: alpha
alertRefOverrides:
  12345-1:
    name: Alert Reference 1

`);
}

The metadata function is evaluated upon saving the script, which is exposed as a scan rule if the metadata is valid.

Scripts tree tab

Mon, 01 Jan 0001 00:00:00 +0000

Scripts tree tab

The Scripts tree tab shows you all of the scripts you currently have loaded organized by type.

It also shows you which templates you have available - these cannot be run directly, you use them to create new scripts.

It also allows you to add new scripts, load, save and remove them.