Data going into zap.log

[Naveen Rajamannar]

Hi,

Can we send assert details of standalone scripts to zap.log files?

Thanks,

[thc...@gmail.com]

Hi.

Yes, just create the logger and log, e.g.:
https://github.com/zaproxy/community-scripts/blob/6b0ed32946b01b421c87c71baa43efcd666cf6bc/active/SSTI.js#L11-L12

Best regards.

[Naveen Rajamannar]

Thanks, I tried to implement the following code 

var LoggerManager = Java.type("org.apache.logging.log4j.LogManager");
var log = LoggerManager.getLogger("SSTI");

log.debug("-------------------HELLO-----------------------")

But did not see any logs in the zap.log file. Is this right way doing?

[thc...@gmail.com]

It's the right way to do it but debug level is not enabled by default,
try with info or error.

Alternatively, enable debug level for that name:
https://www.zaproxy.org/faq/how-do-you-configure-zap-logging/


Best regards.

[Naveen Rajamannar]

Thanks a lot that helped, one last question, What is the syntax to write for a particular name. is the following correct for a standalone scripte "org.zaproxy.zap.extension.standAlone.WriteAlertsToFile" : Level.DEBUG,

[Naveen Rajamannar]

Hi, Also can I change the pattern to JSON

Thanks,

On Monday, 6 March 2023 at 22:02:04 UTC+5:30 thc202 wrote:

[thc...@gmail.com]

That's the name you provide when getting the logger, in the example you
posted it would be "SSTI".

Best regards.

[thc...@gmail.com]

That's a Log4j2 question rather than ZAP one, looking at their docs it
seems to be possible:
https://logging.apache.org/log4j/2.x/manual/json-template-layout.html

Note that you can write to a custom file the JSON yourself (e.g.
JSON.stringify an object).
There are examples in the Community Scripts repo on how to write to
files from the scripts, e.g.:
https://github.com/zaproxy/community-scripts/blob/6b0ed32946b01b421c87c71baa43efcd666cf6bc/httpsender/LogMessages.js

Best regards.

[Naveen Rajamannar]

Thanks, will go through