Do I need/can configure Passive Scan Rules for AjaxSpider?

[JWeb Dev]

Hello OWASP Community, 

I've been reading the documentation for hours now and trying to figure it out.

Please tell me. If I want to run an AjaxSpider. Do I need to set "passive scan rules"? Do they have any effect on AjaxSpider scanning?

In the simple spider scannong I did like this. api.pscan.enableScanners(ids). 

Do I also need to enable passive scan rules before running AjaxSpider? Hope my question is clear.

Thanks!

[thc...@gmail.com]

Hi.

The passive scan happens by default you don't need to do extra
configurations for the messages of the standard spider and AJAX Spider
to be passive scanned:
https://www.zaproxy.org/docs/desktop/start/features/pscan/

The rules are enabled by default too.

Best regards.

On 11/03/2023 12:39, JWeb Dev wrote:
> Hello OWASP Community,
>
> I've been reading the documentation for hours now and trying to figure it
> out.
>
> Please tell me. If I want to run an AjaxSpider. Do I need to set "passive
> scan rules"? Do they have any effect on AjaxSpider scanning?
>
> In the simple spider scannong I did like this.

> *api.pscan.enableScanners(ids)*.

[JWeb Dev]

Hi thc202,

I don't need all the passive scanners. I want to disable some. Did I understand you correctly that if I configure them in the same way as I did in the passive scanner, they will have an impact?

Thanks

[Muhammad Zubair]

If you want to run an AjaxSpider with ZAP (Zed Attack Proxy), you do not need to explicitly set "passive scan rules" before running the AjaxSpider.

Passive scan rules are enabled by default in ZAP, and they will automatically be applied to the requests generated by the AjaxSpider. Therefore, you do not need to take any additional steps to enable passive scan rules specifically for AjaxSpider scanning.

However, you can customize which passive scan rules are applied by modifying the "Scan Policy" in the ZAP options. The Scan Policy allows you to enable or disable specific passive scan rules, so you can tailor the scanning to your specific needs.

To run an AjaxSpider in ZAP, you can use the following code:

python
Copy code
# Import the ZAP API client
from zapv2 import ZAPv2

# Create a ZAP API client
zap = ZAPv2()

# Start the AjaxSpider
zap.ajaxSpider.scan('http://example.com')
This will start the AjaxSpider scanning the specified target URL. If you want to enable specific scanners during the AjaxSpider scan, you can use the api.pscan.enableScanners(ids) method that you mentioned in your question. However, as mentioned above, you do not need to enable passive scan rules specifically for AjaxSpider scanning, as they are enabled by default.

[JWeb Dev]

Hi. thanks for a good explanation. This is exactly what I want to understand. Seems to understand. The fact is that, I want to configure which passive scan rules to use when scanning with AjaxSpeeder. I'm using api, and it's better for me if I set the rules that I myself will mark, and not use different policies. Thank you!

[Muhammad Zubair]

Keep smiling 

[thc...@gmail.com]

You should call `disableAllScanners` before calling `enableScanners`,
the one you mentioned only enables the specified ones it does not
automatically disable the others.

https://www.zaproxy.org/docs/api/#pscanactiondisableallscanners

Best regards.

[JWeb Dev]

Thanks. I do exactly this.  disableAllScanners and then put only needed.