如何使用 OWASP ZAP 的 spiderViewStatus Java API 來獲取 Spider 完成工作的狀態/百分比？

Question

我正在關注Using Spider的 API 文檔。 基於 Java 的代碼塊效果很好，我得到了 output。

• 代碼：

   import java.util.List; import org.zaproxy.clientapi.core.ApiResponse; import org.zaproxy.clientapi.core.ApiResponseElement; import org.zaproxy.clientapi.core.ApiResponseList; import org.zaproxy.clientapi.core.ClientApi; public class SpiderViewStatus { private static final String ZAP_ADDRESS = "localhost"; private static final int ZAP_PORT = 8080; // Change to match the API key set in ZAP, or use NULL if the API key is disabled private static final String ZAP_API_KEY = "93tpvc1c5ek2b94arh0e7c8he"; // The URL of the application to be tested private static final String TARGET = "https://public-firing-range.appspot.com"; //private static final String TARGET = "http://localhost:3000"; //Juice Shop public static void main(String[] args) { ClientApi api = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY); try { // Start spidering the target System.out.println("Spidering target: " + TARGET); ApiResponse resp = api.spider.scan(TARGET, null, null, null, null); String scanID; int progress; // The scan returns a scan id to support concurrent scanning scanID = ((ApiResponseElement) resp).getValue(); // Poll the status until it completes while (true) { Thread.sleep(1000); progress = Integer.parseInt(((ApiResponseElement) api.spider.status(scanID)).getValue()); System.out.println("Spider progress: " + progress + "%"); if (progress >= 100) { break; } } System.out.println("Spider completed"); // If required post process the spider results List<ApiResponse> spiderResults = ((ApiResponseList) api.spider.results(scanID)).getItems(); for (ApiResponse spiderResult:spiderResults) System.out.println(spiderResult); // TODO: Explore the Application more with Ajax Spider or Start scanning the application for vulnerabilities } catch (Exception e) { System.out.println("Exception: " + e.getMessage()); e.printStackTrace(); } } }

• Output：

   Spidering target: https://public-firing-range.appspot.com Spider progress: 0% Spider progress: 66% Spider progress: 100% Spider completed https://public-firing-range.appspot.com/sitemap.xml https://public-firing-range.appspot.com/robots.txt https://public-firing-range.appspot.com

---

在“查看狀態”部分中，還提到執行狀態 API以獲取蜘蛛完成工作的狀態/百分比。 但是，當我 append 的代碼塊spiderViewStatus ：

• 代碼塊：

   System.out.println("Spider completed"); // If required post process the spider results //spiderViewStatus: https://www.zaproxy.org/docs/api/#spiderviewstatus URL obj = new URL("http://zap/JSON/spider/view/status/"); HttpURLConnection con = (HttpURLConnection) obj.openConnection(); con.setRequestMethod("GET"); int responseCode = con.getResponseCode(); BufferedReader in = new BufferedReader( new InputStreamReader(con.getInputStream())); String inputLine; StringBuffer response = new StringBuffer(); while ((inputLine = in.readLine()).= null) { response;append(inputLine). } in;close(). System.out.println(response;toString()): // TODO: Explore the Application more with Ajax Spider or Start scanning the application for vulnerabilities

我面臨java.net.UnknownHostException: zap如下：

• 錯誤堆棧跟蹤：

   Spidering target: https://public-firing-range.appspot.com Spider progress: 66% Spider progress: 100% Spider completed Exception: zap java.net.UnknownHostException: zap at java.net.AbstractPlainSocketImpl.connect(Unknown Source) at java.net.PlainSocketImpl.connect(Unknown Source) at java.net.SocksSocketImpl.connect(Unknown Source) at java.net.Socket.connect(Unknown Source) at java.net.Socket.connect(Unknown Source) at sun.net.NetworkClient.doConnect(Unknown Source) at sun.net.www.http.HttpClient.openServer(Unknown Source) at sun.net.www.http.HttpClient.openServer(Unknown Source) at sun.net.www.http.HttpClient.<init>(Unknown Source) at sun.net.www.http.HttpClient.New(Unknown Source) at sun.net.www.http.HttpClient.New(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.connect(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source) at java.net.HttpURLConnection.getResponseCode(Unknown Source) at ZAP_tests.SpiderViewStatus.main(SpiderViewStatus.java:52)

我試圖用http://localhost:8080/JSON/spider/view/status/替換http://zap/JSON/spider/view/status/ /view/status/ 仍然是同樣的錯誤。

誰能幫幫我？

Answer 1

您已經使用api.spider.status(scanID)在初始代碼中調用該端點

http://zap/主機僅在您通過 ZAP 進行代理時才有效，您的代碼的第二部分中似乎沒有。