在线程 "main" org.zaproxy.clientapi.core.ClientApiException 中获取异常：在 运行 上不存在使用 zap api 的表单 ans 脚本身份验证

Question

public class FormAuth {

private static final String ZAP_ADDRESS = "localhost";
private static final int ZAP_PORT = 8080;
private static final String ZAP_API_KEY = null;
private static final String contextId = "1";
private static final String contextName = "Default Context";
private static final String target = "http://localhost:8090/bodgeit";

private static void setIncludeAndExcludeInContext(ClientApi clientApi) throws UnsupportedEncodingException, ClientApiException {
    String includeInContext = "http://localhost:8090/bodgeit.*";
    String excludeInContext = "http://localhost:8090/bodgeit/logout.jsp";

    clientApi.context.includeInContext(contextName, includeInContext);
    clientApi.context.excludeFromContext(contextName, excludeInContext);
}


private static void setLoggedInIndicator(ClientApi clientApi) throws UnsupportedEncodingException, ClientApiException {
    // Prepare values to set, with the logged in indicator as a regex matching the logout link
    String loggedInIndicator = "<a href=\"logout.jsp\">Logout</a>";

    // Actually set the logged in indicator
    clientApi.authentication.setLoggedInIndicator(contextId, java.util.regex.Pattern.quote(loggedInIndicator));

    // Check out the logged in indicator that is set
    System.out.println("Configured logged in indicator regex: "
            + ((ApiResponseElement) clientApi.authentication.getLoggedInIndicator(contextId)).getValue());
}

private static void setFormBasedAuthenticationForBodgeit(ClientApi clientApi) throws ClientApiException,
        UnsupportedEncodingException {
    // Setup the authentication method

    String loginUrl = "http://localhost:8090/bodgeit/login.jsp";
    String loginRequestData = "username={%username%}&password={%password%}";

    // Prepare the configuration in a format similar to how URL parameters are formed. This
    // means that any value we add for the configuration values has to be URL encoded.
    StringBuilder formBasedConfig = new StringBuilder();
    formBasedConfig.append("loginUrl=").append(URLEncoder.encode(loginUrl, "UTF-8"));
    formBasedConfig.append("&loginRequestData=").append(URLEncoder.encode(loginRequestData, "UTF-8"));

    System.out.println("Setting form based authentication configuration as: "
            + formBasedConfig.toString());
    clientApi.authentication.setAuthenticationMethod(contextId, "formBasedAuthentication",
            formBasedConfig.toString());

    // Check if everything is set up ok
    System.out
            .println("Authentication config: " + clientApi.authentication.getAuthenticationMethod(contextId).toString(0));
}

private static String setUserAuthConfigForBodgeit(ClientApi clientApi) throws ClientApiException, UnsupportedEncodingException {
    // Prepare info
    String user = "Test User";
    String username = "test@example.com";
    String password = "weakPassword";

    // Make sure we have at least one user
    String userId = extractUserId(clientApi.users.newUser(contextId, user));

    // Prepare the configuration in a format similar to how URL parameters are formed. This
    // means that any value we add for the configuration values has to be URL encoded.
    StringBuilder userAuthConfig = new StringBuilder();
    userAuthConfig.append("username=").append(URLEncoder.encode(username, "UTF-8"));
    userAuthConfig.append("&password=").append(URLEncoder.encode(password, "UTF-8"));

    System.out.println("Setting user authentication configuration as: " + userAuthConfig.toString());
    clientApi.users.setAuthenticationCredentials(contextId, userId, userAuthConfig.toString());
    clientApi.users.setUserEnabled(contextId, userId, "true");
    clientApi.forcedUser.setForcedUser(contextId, userId);
    clientApi.forcedUser.setForcedUserModeEnabled(true);

    // Check if everything is set up ok
    System.out.println("Authentication config: " + clientApi.users.getUserById(contextId, userId).toString(0));
    return userId;
}

private static String extractUserId(ApiResponse response) {
    return ((ApiResponseElement) response).getValue();
}

private static void scanAsUser(ClientApi clientApi, String userId) throws ClientApiException {
    clientApi.spider.scanAsUser(contextId, userId, target, null, "true", null);
}

/**
 * The main method.
 *
 * @param args the arguments
 * @throws ClientApiException
 * @throws UnsupportedEncodingException
 */
public static void main(String[] args) throws ClientApiException, UnsupportedEncodingException {
    ClientApi clientApi = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

    setIncludeAndExcludeInContext(clientApi);
    setFormBasedAuthenticationForBodgeit(clientApi);
    setLoggedInIndicator(clientApi);
    String userId = setUserAuthConfigForBodgeit(clientApi);
    scanAsUser(clientApi, userId);
}

}

============================================= ============================================

/usr/lib/jvm/java-1.11.0-openjdk-amd64/bin/java -javaagent:/snap/intellij-idea-ultimate/319/lib/idea_rt.jar=43425:/snap/intellij-idea-ultimate/319/bin -Dfile.encoding=UTF-8 -class路径/home/arpit/IdeaProjects/maven-zap-demo/target/classes:/home/arpit/Downloads/zap-clientapi-1.9.0.jar ScriptAuth 线程“main”中的异常 org.zaproxy.clientapi.core.ClientApiException：不存在 在 org.zaproxy.clientapi.core.ApiResponseFactory.getResponse(ApiResponseFactory.java:50) 在 org.zaproxy.clientapi.core.ClientApi.callApi(ClientApi.java:351) 在 org.zaproxy.clientapi.gen.deprecated.ScriptDeprecated.load(ScriptDeprecated.java:146) 在 ScriptAuth.uploadScript(ScriptAuth.java:76) 在 ScriptAuth.main(ScriptAuth.java:93)

Answer 1

在 ZAP 中自动进行身份验证的推荐方法是在桌面上配置和测试它，然后导出上下文并通过 API 导入它。如果身份验证使用脚本，则需要先向 ZAP 注册。