OWASP-ZAP: How to Pause traditional spider using script

user_4301318 0
Viewed 53

I have an requirement where I need to pause spider on the following condition

  1. when response code is 302
  2. when response header has location with value set to login page eg: "login.jsp"

Following is what I am currently doing Script: HTTP sender Engine: Jython Script:

import httplib
HOST = "127.0.0.1"
PORT = 2031
APIKEY="2031"

def sendingRequest(msg, initiator, helper):pass
    
def responseReceived(msg, initiator, helper):
    if initiator == 3:
        try:
            h=httplib.HTTPConnection("{0}:{1}".format(HOST,PORT))
            if h:
                if msg.getResponseHeader() and msg.getResponseHeader().getStatusCode()==302:
                    if msg.getResponseHeader().getHeader("Location") is not None:
                        if "Login.jsp" in msg.getResponseHeader().getHeader("Location"):
                            h.request("GET", "/JSON/spider/action/pauseAllScans/?apikey={0}".format(APIKEY))
                            
                            
        except: pass

I was wondering if their is any other or better way to achieve this?

Thank you in advance.

zap owasp
1 Answers

You havnt sai why you want to pause the scans. My guess is that so you can re-authenticate. If so then I think the better option is to configure ZAP to handle authentication, then it will automatically re-authenticate if the user ever gets logged out. If you really want to do it your way then you dont have to make an API call - your script is already running in ZAP and so will be able to pause the spider via code.

user_15098340
Related