How to set "OOB service used in active scan" from an addon

[Aakhash Ganesh]

Hello,

I'm writing an active scan addon that needs zap to use interactsh for the scan. I'm running zap as a headless instance, so I don't have access to the options panel. I was able to set the Interactsh value such as the server url and token in my addon file, but I don't see how I can set the "OOB service used in active scan" in the oast general tab to interactsh.

I've tried to set the value by doing
            getConfig().setProperty("oast.activeScanService", "interactsh");
in my init, and by trying to modify the value through the class. I don't see how to change the value. I would appreciate any help on the matter.

[psiinon]

You should be able to change any of the config values via the "-config" command line option (or the -configfile one)

See https://www.zaproxy.org/faq/how-do-you-find-out-what-key-to-use-to-set-a-config-value-on-the-command-line/

Cheers,

Simon

[Aakhash Ganesh]

Thank you so much, I have a follow up question if you don't mind.

I'm trying to initialize the interactsh values from what I found in the developer site and the index. So I have the following:

public void init() {
       
        final ExtensionOast extOast = Control.getSingleton().getExtensionLoader().getExtension(ExtensionOast.class);
        final InteractshService interact = extOast.getInteractshService();
        interact.getParam().setServerUrl(interactshURL);
        interact.getParam().setAuthToken(interactshToken);
        interact.getParam().setPollingFrequency(10);
        try {
            final String payload = interact.getNewPayload();
        } catch (final Exception e1) {
            e1.printStackTrace();
        }

    }

What is the best way for me to get the values for interactshURL, and interactshToken if I need to get them from an API call? I can't hardcode the information into the addon. So I need to reach out to an api to get the proper url and token values. This might just be more of a java question than a zap but trying to emulate the curl functionality in java through HttpURLConnection did not work for me.