|
| 1 | +#!/usr/bin/env python |
| 2 | +# A basic ZAP Python API example which spiders and scans a target URL |
| 3 | + |
| 4 | +import time |
| 5 | +from pprint import pprint |
| 6 | +from zapv2 import ZAPv2 |
| 7 | + |
| 8 | +target = 'http://127.0.0.1' |
| 9 | +apikey = 'changeme' # Change to match the API key set in ZAP, or use None if the API key is disabled |
| 10 | +# |
| 11 | +# By default ZAP API client will connect to port 8080 |
| 12 | +zap = ZAPv2(apikey=apikey) |
| 13 | +# Use the line below if ZAP is not listening on port 8080, for example, if listening on port 8090 |
| 14 | +# zap = ZAPv2(apikey=apikey, proxies={'http': 'http://127.0.0.1:8090', 'https': 'http://127.0.0.1:8090'}) |
| 15 | + |
| 16 | +# Proxy a request to the target so that ZAP has something to deal with |
| 17 | +print 'Accessing target %s' % target |
| 18 | +zap.urlopen(target) |
| 19 | +# Give the sites tree a chance to get updated |
| 20 | +time.sleep(2) |
| 21 | + |
| 22 | +print 'Spidering target %s' % target |
| 23 | +scanid = zap.spider.scan(target) |
| 24 | +# Give the Spider a chance to start |
| 25 | +time.sleep(2) |
| 26 | +while (int(zap.spider.status(scanid)) < 100): |
| 27 | + # Loop until the spider has finished |
| 28 | + print 'Spider progress %: ' + zap.spider.status(scanid) |
| 29 | + time.sleep(2) |
| 30 | + |
| 31 | +print 'Spider completed' |
| 32 | + |
| 33 | +while (int(zap.pscan.records_to_scan) > 0): |
| 34 | + print ('Records to passive scan : ' + zap.pscan.records_to_scan) |
| 35 | + time.sleep(2) |
| 36 | + |
| 37 | +print 'Passive Scan completed' |
| 38 | + |
| 39 | +print 'Active Scanning target %s' % target |
| 40 | +scanid = zap.ascan.scan(target) |
| 41 | +while (int(zap.ascan.status(scanid)) < 100): |
| 42 | + # Loop until the scanner has finished |
| 43 | + print 'Scan progress %: ' + zap.ascan.status(scanid) |
| 44 | + time.sleep(5) |
| 45 | + |
| 46 | +print 'Active Scan completed' |
| 47 | + |
| 48 | +# Report the results |
| 49 | + |
| 50 | +print 'Hosts: ' + ', '.join(zap.core.hosts) |
| 51 | +print 'Alerts: ' |
| 52 | +pprint (zap.core.alerts()) |
0 commit comments