From 58311391485889c6e8dbba653f6b7560243fffb9 Mon Sep 17 00:00:00 2001 From: thc202 Date: Wed, 12 Apr 2023 09:51:40 +0100 Subject: [PATCH] Update ZAP to 2.12 Remove compatibility code that's no longer needed, that provided singletons. Use provided singletons (`control` and `model`) in Python scripts. Use non-deprecated `HttpSender` constructor and use constant instead of the literal for the initiator value (clearer). Signed-off-by: thc202 --- CHANGELOG.md | 4 ++++ .../juiceshop-selenium-auth/JuiceShopAuthentication.js | 3 +-- af-plans/juiceshop-selenium-auth/JuiceShopReset.js | 3 +-- build.gradle.kts | 2 +- extender/Simple Reverse Proxy.js | 5 ----- httpfuzzerprocessor/add_msgs_sites_tree.js | 3 --- httpsender/Alert on HTTP Response Code Errors.js | 4 ---- httpsender/Alert on Unexpected Content Types.js | 4 ---- standalone/Active scan rule list.js | 3 --- standalone/Juice shop authentication by form.js | 3 --- standalone/Juice shop authentication by google.js | 3 --- standalone/Loop through alerts.js | 3 --- standalone/Loop through history table.js | 3 --- standalone/SecurityCrawlMazeScore.js | 3 --- standalone/Traverse sites tree.js | 3 --- standalone/WebSocketExportToOrg.py | 2 +- standalone/alertAndPluginDetails.js | 3 --- standalone/extHistoryEnumerator.py | 4 ++-- standalone/historySourceTagger.js | 3 --- standalone/load_context_from_burp.py | 2 +- standalone/past_cookies_jar.py | 4 ++-- standalone/scan_rule_list.js | 3 --- targeted/ElasticSearchExploit.js | 5 ++--- targeted/Find largest subtree.js | 3 --- targeted/Remove 302s.js | 3 --- targeted/WordPress User Enumeration.js | 7 +------ targeted/cve-2021-22214.js | 6 +----- targeted/cve-2021-41773-apache-path-trav.js | 7 +------ targeted/dns-email-spoofing.js | 7 +------ 29 files changed, 19 insertions(+), 89 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 20d7e1fe..f980772f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## [Unreleased] ### Changed +- Update minimum ZAP version to 2.12.0: + - Remove compatibility code that provided the singletons (`control` and `model`) in JavaScript scripts, they can now be accessed directly always. + - Use provided singletons (`control` and `model`) in Python scripts. + - Use non-deprecated `HttpSender` constructor. - Remove statements that return the message in HTTP Sender scripts, the message passed as parameter is used/sent always. ## [16] - 2023-03-29 diff --git a/af-plans/juiceshop-selenium-auth/JuiceShopAuthentication.js b/af-plans/juiceshop-selenium-auth/JuiceShopAuthentication.js index e8fe3f95..811d8539 100644 --- a/af-plans/juiceshop-selenium-auth/JuiceShopAuthentication.js +++ b/af-plans/juiceshop-selenium-auth/JuiceShopAuthentication.js @@ -72,8 +72,7 @@ function authenticate(helper, _paramsValues, _credentials) { } logger("Launching browser to authenticate to Juice Shop"); - var extSel = control.getSingleton(). - getExtensionLoader().getExtension( + var extSel = control.getExtensionLoader().getExtension( org.zaproxy.zap.extension.selenium.ExtensionSelenium.class); // Change to "firefox" (or "chrome") to see the browsers being launched diff --git a/af-plans/juiceshop-selenium-auth/JuiceShopReset.js b/af-plans/juiceshop-selenium-auth/JuiceShopReset.js index e193e233..b390eeef 100644 --- a/af-plans/juiceshop-selenium-auth/JuiceShopReset.js +++ b/af-plans/juiceshop-selenium-auth/JuiceShopReset.js @@ -32,8 +32,7 @@ if (token) { } // Reset the state for all users -var extUser = control.getSingleton(). - getExtensionLoader().getExtension( +var extUser = control.getExtensionLoader().getExtension( org.zaproxy.zap.extension.users.ExtensionUserManagement.class); var session = model.getSession(); var contexts = session.getContexts(); diff --git a/build.gradle.kts b/build.gradle.kts index 3d1b1c33..cfb545ed 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -22,7 +22,7 @@ val scriptsDir = layout.buildDirectory.dir("scripts") zapAddOn { addOnId.set("communityScripts") addOnName.set("Community Scripts") - zapVersion.set("2.11.0") + zapVersion.set("2.12.0") addOnStatus.set(AddOnStatus.ALPHA) releaseLink.set("https://github.com/zaproxy/community-scripts/compare/v@PREVIOUS_VERSION@...v@CURRENT_VERSION@") diff --git a/extender/Simple Reverse Proxy.js b/extender/Simple Reverse Proxy.js index cf6866ac..5ab2298f 100644 --- a/extender/Simple Reverse Proxy.js +++ b/extender/Simple Reverse Proxy.js @@ -1,9 +1,4 @@ // An extender script that adds a simple reverse proxy. -// Requires a ZAP version greater than 2.7.0. - -var control, model -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton() -if (!model) model = Java.type("org.parosproxy.paros.model.Model").getSingleton() // To where the requests are sent. var remoteAddress = "example.com" diff --git a/httpfuzzerprocessor/add_msgs_sites_tree.js b/httpfuzzerprocessor/add_msgs_sites_tree.js index acb5960c..82b08608 100644 --- a/httpfuzzerprocessor/add_msgs_sites_tree.js +++ b/httpfuzzerprocessor/add_msgs_sites_tree.js @@ -2,9 +2,6 @@ // with messages sent by the fuzzer (by default the fuzz result/messages // are not shown in the Fuzzer tab). -var model; -if (!model) model = Java.type("org.parosproxy.paros.model.Model").getSingleton(); - var session = model.getSession(); function processMessage(utils, message) {} diff --git a/httpsender/Alert on HTTP Response Code Errors.js b/httpsender/Alert on HTTP Response Code Errors.js index cfe9edcd..dab411e8 100644 --- a/httpsender/Alert on HTTP Response Code Errors.js +++ b/httpsender/Alert on HTTP Response Code Errors.js @@ -2,10 +2,6 @@ // By default it will raise 'Info' level alerts for Client Errors (4xx) (apart from 404s) and 'Low' Level alerts for Server Errors (5xx) // But it can be easily changed. -var control, model -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton() -if (!model) model = Java.type("org.parosproxy.paros.model.Model").getSingleton() - var Pattern = Java.type("java.util.regex.Pattern") pluginid = 100000 // https://github.com/zaproxy/zaproxy/blob/main/docs/scanners.md diff --git a/httpsender/Alert on Unexpected Content Types.js b/httpsender/Alert on Unexpected Content Types.js index 3d5e970a..dc074b18 100644 --- a/httpsender/Alert on Unexpected Content Types.js +++ b/httpsender/Alert on Unexpected Content Types.js @@ -2,10 +2,6 @@ // By default it will raise 'Low' level alerts for content types that are not expected to be returned by APIs. // But it can be easily changed. -var control, model -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton() -if (!model) model = Java.type("org.parosproxy.paros.model.Model").getSingleton() - var Pattern = Java.type("java.util.regex.Pattern") var pluginid = 100001 // https://github.com/zaproxy/zaproxy/blob/main/docs/scanners.md diff --git a/standalone/Active scan rule list.js b/standalone/Active scan rule list.js index c88883ba..13cf966c 100644 --- a/standalone/Active scan rule list.js +++ b/standalone/Active scan rule list.js @@ -1,8 +1,5 @@ // This script gives details about all of the active scan rules installed -var control; -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton(); - extAscan = control.getExtensionLoader().getExtension( org.zaproxy.zap.extension.ascan.ExtensionActiveScan.NAME); diff --git a/standalone/Juice shop authentication by form.js b/standalone/Juice shop authentication by form.js index b309a163..6c16aae1 100644 --- a/standalone/Juice shop authentication by form.js +++ b/standalone/Juice shop authentication by form.js @@ -4,9 +4,6 @@ // a user with a name of test@test.com and a password of test123 // You can change any of the variables to match your environment if needed. -var control; -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton(); - var By = Java.type('org.openqa.selenium.By'); var Thread = Java.type('java.lang.Thread'); var juiceshop = 'http://localhost:3000/'; diff --git a/standalone/Juice shop authentication by google.js b/standalone/Juice shop authentication by google.js index b74426bf..f59e1f49 100644 --- a/standalone/Juice shop authentication by google.js +++ b/standalone/Juice shop authentication by google.js @@ -3,9 +3,6 @@ // Juice Shop will need to be accessible via http://localhost:3000/ and you will need to change the // username and password to match a valid Google account. -var control -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton() - var By = Java.type('org.openqa.selenium.By'); var Thread = Java.type('java.lang.Thread'); var juiceshop = 'http://localhost:3000/'; diff --git a/standalone/Loop through alerts.js b/standalone/Loop through alerts.js index 59fa3a7a..19106e01 100644 --- a/standalone/Loop through alerts.js +++ b/standalone/Loop through alerts.js @@ -2,9 +2,6 @@ // // This is a standalone script which you can run from the Script Console -var control -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton() - extAlert = control.getExtensionLoader().getExtension( org.zaproxy.zap.extension.alert.ExtensionAlert.NAME) if (extAlert != null) { diff --git a/standalone/Loop through history table.js b/standalone/Loop through history table.js index 575824e6..2e683637 100644 --- a/standalone/Loop through history table.js +++ b/standalone/Loop through history table.js @@ -3,9 +3,6 @@ // Standalone scripts have no template. // They are only evaluated when you run them. -var control -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton() - extHist = control.getExtensionLoader().getExtension( org.parosproxy.paros.extension.history.ExtensionHistory.NAME) if (extHist != null) { diff --git a/standalone/SecurityCrawlMazeScore.js b/standalone/SecurityCrawlMazeScore.js index bedf92bd..fd0f601f 100644 --- a/standalone/SecurityCrawlMazeScore.js +++ b/standalone/SecurityCrawlMazeScore.js @@ -2,9 +2,6 @@ // // You will need to have run one or both of the ZAP spiders against https://security-crawl-maze.app/ -var model -if (!model) model = Java.type("org.parosproxy.paros.model.Model").getSingleton() - // Expected results sourced from: // https://raw.githubusercontent.com/google/security-crawl-maze/master/blueprints/utils/resources/expected-results.json diff --git a/standalone/Traverse sites tree.js b/standalone/Traverse sites tree.js index ec9cbaad..4fb38d81 100644 --- a/standalone/Traverse sites tree.js +++ b/standalone/Traverse sites tree.js @@ -3,9 +3,6 @@ // Standalone scripts have no template. // They are only evaluated when you run them. -var model -if (!model) model = Java.type("org.parosproxy.paros.model.Model").getSingleton() - function listChildren(node, level) { var j; for (j=0;j " + uri.toString()); // Initialise the sender - var sender = new HttpSender(connectionParams, true, 6); + var sender = new HttpSender(HttpSender.MANUAL_REQUEST_INITIATOR); // Send and Receive Request sender.sendAndReceive(newReq); // Debugging diff --git a/targeted/cve-2021-22214.js b/targeted/cve-2021-22214.js index e6b68d64..e258b74c 100644 --- a/targeted/cve-2021-22214.js +++ b/targeted/cve-2021-22214.js @@ -5,10 +5,6 @@ var pluginid = 100024; -var control, model -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton() -if (!model) model = Java.type("org.parosproxy.paros.model.Model").getSingleton() - var HttpSender = Java.type("org.parosproxy.paros.network.HttpSender") var HistoryReference = Java.type("org.parosproxy.paros.model.HistoryReference") var HttpHeader = Java.type("org.parosproxy.paros.network.HttpHeader") @@ -88,7 +84,7 @@ function invokeWith(msg) { */ function sendReq(msg) { var newReq = generateRequest(msg); - var sender = new HttpSender(model.getOptionsParam().getConnectionParam(), true, 6) + var sender = new HttpSender(HttpSender.MANUAL_REQUEST_INITIATOR) sender.sendAndReceive(newReq); // Debugging // logger("Request Header -> " + newReq.getRequestHeader().toString()) diff --git a/targeted/cve-2021-41773-apache-path-trav.js b/targeted/cve-2021-41773-apache-path-trav.js index 66deaf3b..52f542ed 100644 --- a/targeted/cve-2021-41773-apache-path-trav.js +++ b/targeted/cve-2021-41773-apache-path-trav.js @@ -3,10 +3,6 @@ * Based on: https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse */ -var control, model -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton() -if (!model) model = Java.type("org.parosproxy.paros.model.Model").getSingleton() - var HttpSender = Java.type("org.parosproxy.paros.network.HttpSender") var HistoryReference = Java.type("org.parosproxy.paros.model.HistoryReference") var HttpHeader = Java.type("org.parosproxy.paros.network.HttpHeader") @@ -43,8 +39,7 @@ function invokeWith(msg) { logger("Testing Script against URL - " + url); msg.getRequestHeader().getURI().setEscapedPath(attackPath); - var connectionParams = model.getOptionsParam().getConnectionParam(); - var sender = new HttpSender(connectionParams, true, 6); + var sender = new HttpSender(HttpSender.MANUAL_REQUEST_INITIATOR); sender.sendAndReceive(msg); var status = msg.getResponseHeader().getStatusCode(); var rebody = msg.getResponseBody().toString(); diff --git a/targeted/dns-email-spoofing.js b/targeted/dns-email-spoofing.js index b5ad3abb..7f6df247 100644 --- a/targeted/dns-email-spoofing.js +++ b/targeted/dns-email-spoofing.js @@ -5,10 +5,6 @@ var pluginid = 100031; var providerAddress = "dns.google"; -var control, model -if (!control) control = Java.type("org.parosproxy.paros.control.Control").getSingleton() -if (!model) model = Java.type("org.parosproxy.paros.model.Model").getSingleton() - var URI = Java.type("org.apache.commons.httpclient.URI"); var HttpSender = Java.type("org.parosproxy.paros.network.HttpSender"); var HistoryReference = Java.type("org.parosproxy.paros.model.HistoryReference"); @@ -16,7 +12,6 @@ var ExtensionAlert = Java.type("org.zaproxy.zap.extension.alert.ExtensionAlert") var Alert = Java.type("org.parosproxy.paros.core.scanner.Alert"); var session = model.getSession(); -var connectionParams = model.getOptionsParam().getConnectionParam(); var extLoader = control.getExtensionLoader(); // Print statements using script name @@ -121,7 +116,7 @@ function fetchRecords(msg, policy) { msg.getRequestHeader().setURI(requestUri); logger("Fetching TXT records for domain - " + domain); - var sender = new HttpSender(connectionParams, true, 6); + var sender = new HttpSender(HttpSender.MANUAL_REQUEST_INITIATOR); sender.sendAndReceive(msg); // Debugging // logger("Request Header -> " + msg.getRequestHeader().toString())