AJAX Spider can't start firefox-headless

2,200 views
Skip to first unread message

Cameron Swords

unread,
Dec 13, 2019, 9:30:06 AM12/13/19
to OWASP ZAP User Group


Hi there,

Since the recent release of the WebDrivers extension (version 14) our ZAP scans have been unable to start firefox-headless during the AJAX spidering process. Would anyone have any ideas on how I can get this working again?

Kind regards,
Cam



This is the command I'm using to scan:

docker run -ti --rm -v "$PWD":/zap/wrk owasp/zap2docker-weekly:w2019-12-09 zap-baseline.py -j -t http://192.168.0.17


Here is the zap.out log file:

Found Java version 1.8.0_222

Available memory: 1998 MB

Using JVM args: -Xmx499m

155 [main] INFO org.zaproxy.zap.DaemonBootstrap  - OWASP ZAP D-2019-12-09 started 13/12/19 14:24:26 with home /home/zap/.ZAP_D/

184 [main] INFO org.parosproxy.paros.common.AbstractParam  - Setting config api.disablekey = true was null

184 [main] INFO org.parosproxy.paros.common.AbstractParam  - Setting config api.addrs.addr.name = .* was null

184 [main] INFO org.parosproxy.paros.common.AbstractParam  - Setting config api.addrs.addr.regex = true was null

184 [main] INFO org.parosproxy.paros.common.AbstractParam  - Setting config spider.maxDuration = 1 was null

190 [main] INFO org.parosproxy.paros.network.SSLConnector  - Reading supported SSL/TLS protocols...

190 [main] INFO org.parosproxy.paros.network.SSLConnector  - Using a SSLEngine...

278 [main] INFO org.parosproxy.paros.network.SSLConnector  - Done reading supported SSL/TLS protocols: [SSLv2Hello, SSLv3, TLSv1, TLSv1.1, TLSv1.2]

284 [main] INFO org.parosproxy.paros.extension.option.OptionsParamCertificate  - Unsafe SSL renegotiation disabled.

692 [main] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE  - dataFileCache open start

702 [main] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE  - dataFileCache open end

743 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory  - Loading extensions

2140 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory  - Installed add-ons: [[id=accessControl, version=6.0.0], [id=alertFilters, version=10.0.0], [id=ascanrules, version=34.0.0], [id=ascanrulesBeta, version=27.0.0], [id=bruteforce, version=9.0.0], [id=coreLang, version=14.0.0], [id=diff, version=10.0.0], [id=directorylistv1, version=4.0.0], [id=formhandler, version=3.0.0], [id=fuzz, version=12.0.0], [id=gettingStarted, version=11.0.0], [id=help, version=10.0.0], [id=hud, version=0.9.0], [id=importurls, version=7.0.0], [id=invoke, version=10.0.0], [id=onlineMenu, version=7.0.0], [id=openapi, version=15.0.0], [id=plugnhack, version=12.0.0], [id=portscan, version=9.0.0], [id=pscanrules, version=25.0.0], [id=pscanrulesBeta, version=21.0.0], [id=quickstart, version=27.0.0], [id=replacer, version=8.0.0], [id=reveal, version=3.0.0], [id=saverawmessage, version=5.0.0], [id=savexmlmessage, version=0.1.0], [id=scripts, version=26.0.0], [id=selenium, version=15.1.0], [id=sequence, version=6.0.0], [id=spiderAjax, version=23.1.0], [id=tips, version=7.0.0], [id=webdriverlinux, version=14.0.0], [id=webdrivermacos, version=14.0.0], [id=webdriverwindows, version=14.0.0], [id=websocket, version=21.0.0], [id=zest, version=31.0.0]]

2473 [ZAP-daemon] INFO org.zaproxy.zap.control.ExtensionFactory  - Extensions loaded

2592 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows ZAP to check for updates

2595 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Options Extension

2595 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Edit Menu Extension

2595 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Provides a rest based API for controlling and accessing ZAP

2605 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Session State Extension

2605 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Report Extension

2605 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing History Extension

2608 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Show hidden fields and enable disabled fields

2608 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Search messages for strings and regular expressions

2609 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Encode/Decode/Hash...

2610 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to intercept and modify requests and responses

2611 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Passive scanner

2745 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Script Passive Scan Rules

2745 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Stats Passive Scan Rule

2746 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cookie Without SameSite Attribute

2746 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cross-Domain Misconfiguration

2746 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Information Disclosure - Sensitive Information in URL

2746 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Information Disclosure - Sensitive Information in HTTP Referrer Header

2746 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Information Disclosure - Suspicious Comments

2746 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: HTTP Parameter Override

2746 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Timestamp Disclosure

2746 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Username Hash Found

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-AspNet-Version Response Header Scanner

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-Debug-Token Information Leak

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Application Error Disclosure

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Absence of Anti-CSRF Tokens

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Incomplete or No Cache-control and Pragma HTTP Header Set

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Charset Mismatch

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: CSP Scanner

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Content-Type Header Missing

2747 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cookie No HttpOnly Flag

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Loosely Scoped Cookie

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cookie Without Secure Flag

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Cross-Domain JavaScript Source File Inclusion

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Web Browser XSS Protection Not Enabled

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Information Disclosure - Debug Error Messages

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Weak Authentication Method

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Insecure JSF ViewState

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Secure Pages Include Mixed Content

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Private IP Disclosure

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Session ID in URL Rewrite

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: Viewstate Scanner

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-Content-Type-Options Header Missing

2748 [ZAP-daemon] INFO org.zaproxy.zap.extension.pscan.ExtensionPassiveScan  - loaded passive scan rule: X-Frame-Options Header Scanner

2767 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to view and manage alerts

2770 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Active scanner, heavily based on the original Paros active scanner, but with additional tests added

2776 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionSequence

2777 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Spider used for automatically finding URIs on a site

2783 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing A set of common popup menus for miscellaneous tasks

2783 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Forced browsing of files and directories using code from the OWASP DirBuster tool

2784 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Simple but effective port scanner

2785 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Manual Request Editor Extension

2785 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Compares 2 sessions and generates an HTML file showing the differences

2785 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Invoke external applications passing context related information such as URLs and parameters

2786 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Handles anti cross site request forgery (CSRF) tokens

2790 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Authentication Extension

2804 [ZAP-daemon] INFO org.zaproxy.zap.extension.authentication.ExtensionAuthentication  - Loaded authentication method types: [Form-based Authentication, HTTP/NTLM Authentication, Manual Authentication, Script-based Authentication, JSON-based Authentication]

2805 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Creates a dynamic SSL certificate to allow SSL communications to be intercepted without warnings being generated by the browser

2806 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Logs errors to the Output tab in development mode only

2806 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Users Extension

2808 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Summarise and analyse FORM and URL parameters as well as cookies

2809 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Script integration

2828 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Scripting console, supports all JSR 223 scripting languages

2894 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Forced User Extension

2894 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Extension handling HTTP sessions

2896 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Zest is a specialized scripting language from Mozilla specifically designed to be used in security tools

3040 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionDiff

3040 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Post Table View Extension

3041 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Simple browser configuration

3041 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Session Management Extension

3047 [ZAP-daemon] INFO org.zaproxy.zap.extension.sessions.ExtensionSessionManagement  - Loaded session management method types: [Cookie-based Session Management, HTTP Authentication Session Management, Script-based Session Management]

3048 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Form Table View Extension

3048 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Capture messages from WebSockets with the ability to set breakpoints.

3061 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to import a file containing URLs which ZAP will access, adding them to the Sites tree

3062 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Core UI related functionality.

3062 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Authorization Extension

3063 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing AJAX Spider, uses Crawljax

3064 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Provides WebDrivers to control several browsers using Selenium and includes HtmlUnit browser.

3071 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Manages the local proxy configurations

3072 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Add-on that adds a set of tools for testing access control in web applications.

3073 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Handles adding Global Excluded URLs

3073 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Adds menu item to refresh the Sites tree

3073 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing OWASP ZAP User Guide

3073 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Provides a URL suitable for calling from target sites

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to configure which extensions are loaded when ZAP starts

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Combined HTTP Panels Extension

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Hex View Extension

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Image View Extension

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Large Request View Extension

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Large Response View Extension

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Query Table View Extension

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing HTTP Panel Syntax Highlighter View Extension

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Adds support for configurable keyboard shortcuts for all of the ZAP menus.

3076 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Active and passive rule configuration

3080 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Statistics

3081 [ZAP-daemon] INFO org.zaproxy.zap.extension.stats.ExtensionStats  - Start recording in memory stats

3082 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Heads Up Display

3121 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionHUDlaunch

3123 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing The ZAP Getting Started Guide

3123 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows you to spider and import OpenAPI (Swagger) definitions 

3140 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Active Scan Rules

3141 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Adds the Quick Start panel for scanning and exploring applications

3143 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Add the option to use the Ajax Spider in the Quick Start scan

3143 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Launch browsers proxying through ZAP

3143 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Launch browsers proxying through ZAP

3145 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing This extension allows a user to change the default values used by ZAP Spiders.

3148 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing The Online menu links

3148 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Context alert rules filter

3151 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Translations of the core language files

3151 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionSaveRawHttpMessage

3151 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Passive Scan Rules - beta

3151 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Tips and Tricks

3151 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Provides the foundation for concrete message types (for example, HTTP, WebSockets) expose fuzzer implementations.

3152 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows to fuzz HTTP messages.

3153 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing ExtensionSaveXMLHttpMessage

3153 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Passive Scan Rules

3153 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Allows to fuzz WebSocket messages.

3153 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Active Scan Rules - beta

3154 [ZAP-daemon] INFO org.parosproxy.paros.extension.ExtensionLoader  - Initializing Easy way to replace strings in requests and responses

3223 [ZAP-daemon] INFO org.zaproxy.zap.extension.callback.ExtensionCallback  - Started callback server on 0.0.0.0:33725

3224 [ZAP-daemon] INFO org.zaproxy.zap.extension.dynssl.ExtensionDynSSL  - Creating new root CA certificate

3615 [ZAP-daemon] INFO org.zaproxy.zap.extension.dynssl.ExtensionDynSSL  - New root CA certificate created

4627 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine  - Add-on update check complete

4630 [ZAP-daemon] INFO org.parosproxy.paros.CommandLine  - Add-on already installed: /zap/./plugin/pscanrulesBeta-beta-21.zap

4631 [ZAP-daemon] INFO org.zaproxy.zap.DaemonBootstrap  - ZAP is now listening on 0.0.0.0:39579

7657 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread  - Starting spidering scan on http://192.168.0.17 at Fri Dec 13 14:24:34 UTC 2019

7660 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Spider initializing...

7687 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Starting spider...

8147 [ZAP-SpiderThreadPool-0-thread-2] INFO org.zaproxy.zap.spider.Spider  - Spidering process is complete. Shutting down...

8150 [ZAP-SpiderShutdownThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread  - Spider scanning complete: true

12691 [ZAP-AjaxSpiderApi] INFO org.zaproxy.zap.extension.spiderAjax.SpiderThread  - Running Crawljax (with firefox-headless): API - http://192.168.0.17

12693 [ZAP-AjaxSpiderApi] INFO org.zaproxy.zap.extension.spiderAjax.SpiderThread  - Starting proxy...

12694 [ZAP-AjaxSpiderApi] INFO org.zaproxy.zap.extension.spiderAjax.SpiderThread  - Proxy started, listening at port [38221].

12993 [ZAP-AjaxSpiderApi] INFO com.crawljax.core.plugin.Plugins  - Loaded org.zaproxy.zap.extension.spiderAjax.SpiderThread$DummyPlugin@42ccac47 as a OnBrowserCreatedPlugin

33341 [ZAP-AjaxSpiderApi] WARN org.zaproxy.zap.extension.spiderAjax.SpiderThread  - Failed to start browser firefox-headless

com.google.inject.ProvisionException: Guice provision errors:


1) Error in custom provider, org.openqa.selenium.WebDriverException: java.net.ConnectException: Failed to connect to localhost/127.0.0.1:3753

Build info: version: 'unknown', revision: 'unknown', time: 'unknown'

System info: host: '171f898d68f5', ip: '172.17.0.4', os.name: 'Linux', os.arch: 'amd64', os.version: '4.9.184-linuxkit', java.version: '1.8.0_222'

Driver info: driver.version: FirefoxDriver

  at com.crawljax.di.ConfigurationModule.configure(ConfigurationModule.java:47)

  while locating com.crawljax.browser.EmbeddedBrowser

    for parameter 0 at com.crawljax.core.CrawlerContext.<init>(CrawlerContext.java:33)

  while locating com.crawljax.core.CrawlerContext

    for parameter 0 at com.crawljax.core.Crawler.<init>(Crawler.java:75)

  while locating com.crawljax.core.Crawler

    for parameter 2 at com.crawljax.core.CrawlTaskConsumer.<init>(CrawlTaskConsumer.java:30)

  while locating com.crawljax.core.CrawlTaskConsumer


1 error

at com.google.inject.internal.InjectorImpl$4.get(InjectorImpl.java:987)

at com.crawljax.core.CrawlController.call(CrawlController.java:66)

at com.crawljax.core.CrawljaxRunner.call(CrawljaxRunner.java:37)

at org.zaproxy.zap.extension.spiderAjax.SpiderThread.run(SpiderThread.java:257)

at java.lang.Thread.run(Thread.java:748)

Caused by: org.openqa.selenium.WebDriverException: java.net.ConnectException: Failed to connect to localhost/127.0.0.1:3753

Build info: version: 'unknown', revision: 'unknown', time: 'unknown'

System info: host: '171f898d68f5', ip: '172.17.0.4', os.name: 'Linux', os.arch: 'amd64', os.version: '4.9.184-linuxkit', java.version: '1.8.0_222'

Driver info: driver.version: FirefoxDriver

at org.openqa.selenium.remote.service.DriverCommandExecutor.execute(DriverCommandExecutor.java:92)

at org.openqa.selenium.remote.RemoteWebDriver.execute(RemoteWebDriver.java:552)

at org.openqa.selenium.remote.RemoteWebDriver.startSession(RemoteWebDriver.java:213)

at org.openqa.selenium.remote.RemoteWebDriver.<init>(RemoteWebDriver.java:131)

at org.openqa.selenium.firefox.FirefoxDriver.<init>(FirefoxDriver.java:147)

at org.zaproxy.zap.extension.selenium.ExtensionSelenium.getWebDriverImpl(ExtensionSelenium.java:777)

at org.zaproxy.zap.extension.selenium.ExtensionSelenium.getWebDriver(ExtensionSelenium.java:700)

at org.zaproxy.zap.extension.selenium.internal.BuiltInSingleWebDriverProvider.getWebDriver(BuiltInSingleWebDriverProvider.java:62)

at org.zaproxy.zap.extension.selenium.ExtensionSelenium.getWebDriverImpl(ExtensionSelenium.java:639)

at org.zaproxy.zap.extension.selenium.ExtensionSelenium.getWebDriver(ExtensionSelenium.java:509)

at org.zaproxy.zap.extension.spiderAjax.SpiderThread$AjaxSpiderBrowserBuilder.get(SpiderThread.java:480)

at org.zaproxy.zap.extension.spiderAjax.SpiderThread$AjaxSpiderBrowserBuilder.get(SpiderThread.java:448)

at com.google.inject.util.Providers$3.get(Providers.java:109)

at com.google.inject.internal.InternalFactoryToProviderAdapter.get(InternalFactoryToProviderAdapter.java:40)

at com.google.inject.internal.SingleParameterInjector.inject(SingleParameterInjector.java:38)

at com.google.inject.internal.SingleParameterInjector.getAll(SingleParameterInjector.java:62)

at com.google.inject.internal.ConstructorInjector.construct(ConstructorInjector.java:84)

at com.google.inject.internal.ConstructorBindingImpl$Factory.get(ConstructorBindingImpl.java:254)

at com.google.inject.internal.SingleParameterInjector.inject(SingleParameterInjector.java:38)

at com.google.inject.internal.SingleParameterInjector.getAll(SingleParameterInjector.java:62)

at com.google.inject.internal.ConstructorInjector.construct(ConstructorInjector.java:84)

at com.google.inject.internal.ConstructorBindingImpl$Factory.get(ConstructorBindingImpl.java:254)

at com.google.inject.internal.SingleParameterInjector.inject(SingleParameterInjector.java:38)

at com.google.inject.internal.SingleParameterInjector.getAll(SingleParameterInjector.java:62)

at com.google.inject.internal.ConstructorInjector.construct(ConstructorInjector.java:84)

at com.google.inject.internal.ConstructorBindingImpl$Factory.get(ConstructorBindingImpl.java:254)

at com.google.inject.internal.InjectorImpl$4$1.call(InjectorImpl.java:978)

at com.google.inject.internal.InjectorImpl.callInContext(InjectorImpl.java:1024)

at com.google.inject.internal.InjectorImpl$4.get(InjectorImpl.java:974)

... 4 more

Caused by: java.net.ConnectException: Failed to connect to localhost/127.0.0.1:3753

at okhttp3.internal.connection.RealConnection.connectSocket(RealConnection.java:247)

at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:165)

at okhttp3.internal.connection.StreamAllocation.findConnection(StreamAllocation.java:257)

at okhttp3.internal.connection.StreamAllocation.findHealthyConnection(StreamAllocation.java:135)

at okhttp3.internal.connection.StreamAllocation.newStream(StreamAllocation.java:114)

at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:42)

at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147)

at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121)

at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:93)

at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147)

at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121)

at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93)

at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147)

at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:126)

at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147)

at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121)

at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:200)

at okhttp3.RealCall.execute(RealCall.java:77)

at org.openqa.selenium.remote.internal.OkHttpClient.execute(OkHttpClient.java:103)

at org.openqa.selenium.remote.ProtocolHandshake.createSession(ProtocolHandshake.java:105)

at org.openqa.selenium.remote.ProtocolHandshake.createSession(ProtocolHandshake.java:74)

at org.openqa.selenium.remote.HttpCommandExecutor.execute(HttpCommandExecutor.java:136)

at org.openqa.selenium.remote.service.DriverCommandExecutor.execute(DriverCommandExecutor.java:83)

... 32 more

Caused by: java.net.ConnectException: Connection refused (Connection refused)

at java.net.PlainSocketImpl.socketConnect(Native Method)

at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)

at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)

at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)

at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)

at java.net.Socket.connect(Socket.java:589)

at okhttp3.internal.platform.Platform.connectSocket(Platform.java:129)

at okhttp3.internal.connection.RealConnection.connectSocket(RealConnection.java:245)

... 54 more

33347 [ZAP-AjaxSpiderApi] INFO org.zaproxy.zap.extension.spiderAjax.SpiderThread  - Stopping proxy...

33448 [ZAP-AjaxSpiderApi] INFO org.zaproxy.zap.extension.spiderAjax.SpiderThread  - Proxy stopped.

33448 [ZAP-AjaxSpiderApi] INFO org.zaproxy.zap.extension.spiderAjax.SpiderThread  - Finished Crawljax: API - http://192.168.0.17

38912 [ZAP-Shutdown] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE  - dataFileCache commit start

38917 [ZAP-Shutdown] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE  - dataFileCache commit end

38921 [ZAP-Shutdown] INFO hsqldb.db.HSQLDB379AF3DEBD.ENGINE  - Database closed

39037 [ZAP-Shutdown] INFO org.zaproxy.zap.extension.api.CoreAPI  - OWASP ZAP D-2019-12-09 terminated.

thc...@gmail.com

unread,
Dec 13, 2019, 11:48:20 AM12/13/19
to zaprox...@googlegroups.com
Hi.

This issue affects older versions of WebDriver add-on (build issue), the
geckodriver was supposed to be 64bits but it's 32bits which fails to run
in the container.

Which previous version was working for you?

Best regards.

thc...@gmail.com

unread,
Dec 13, 2019, 12:03:46 PM12/13/19
to zaprox...@googlegroups.com
An issue has been raised:
https://github.com/zaproxy/zaproxy/issues/5763

Best regards.

Cameron Swords

unread,
Dec 13, 2019, 12:12:52 PM12/13/19
to OWASP ZAP User Group


Well our setup is a little confusing. Technically we actually use the ZAP weekly image as the base image in our Dockerfile. We then install Firefox 59.0.2 and Geckodriver 0.19.1.

If the 32bit version of geckodriver has always been installed incorrectly, I wonder if the change in the webdriverlinux:14.0.0 that affected us was using geckodriver from /home/zap/.ZAP_D/webdriver/linux/64/geckodriver instead of from the path?

Cheers for creating the issue.

Cheers
Cam

thc...@gmail.com

unread,
Dec 15, 2019, 7:54:50 PM12/15/19
to zaprox...@googlegroups.com
Most likely, ZAP uses the bundled geckodriver by default. Although
curious that the issue did not occur before, version 14 did not change
the version of geckodriver (it was changed in version 13).

You can override the path of geckodriver when starting ZAP:
https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsSeleniumOptions

For baseline with:
-z "-config selenium.firefoxDriver=/path/to/geckodriver"

Best regards.

On 13/12/2019 17:12, 'Cameron Swords' via OWASP ZAP User Group wrote:
>
>
> Well our setup is a little confusing. Technically we actually use the ZAP
> weekly image as the base image in our Dockerfile. We then install Firefox
> 59.0.2 and Geckodriver 0.19.1.
>
> If the 32bit version of geckodriver has always been installed incorrectly,
> I wonder if the change in the webdriverlinux:14.0.0 that affected us was
> using geckodriver from /home/zap/.ZAP_D/webdriver/linux/64/geckodriver
> instead of from the path?
>
> Cheers for creating the issue.
>
> Cheers
> Cam
>
>
> On Friday, December 13, 2019 at 5:03:46 PM UTC, thc202 wrote:
>>
>> An issue has been raised:
>> https://github.com/zaproxy/zaproxy/issues/5763
>>
>> Best regards.
>>

Cameron Swords

unread,
Dec 16, 2019, 10:12:24 AM12/16/19
to OWASP ZAP User Group

Awesome, thank you.

Cheers
Cam

Jyothsna L

unread,
Dec 16, 2019, 1:50:52 PM12/16/19
to OWASP ZAP User Group
I also see same  error, using  ZAP weekly image as the base image in my Dockerfile.
what is a workaround?








15135 [ZAP-AjaxSpiderApi] INFO com.crawljax.core.plugin.Plugins  - Loaded org.zaproxy.zap.extension.spiderAjax.SpiderThread$DummyPlugin@17b7810c as a OnBrowserCreatedPlugin


35810 [ZAP-AjaxSpiderApi] WARN org.zaproxy.zap.extension.spiderAjax.SpiderThread  - Failed to start browser firefox-headless


com.google.inject.ProvisionException: Guice provision errors:




1) Error in custom provider, org.openqa.selenium.WebDriverException: java.net.ConnectException: Failed to connect to localhost/127.0.0.1:9281


Build info: version: 'unknown', revision: 'unknown', time: 'unknown'


System info: host: '1b063d2841dd', ip: '172.17.0.2', os.name: 'Linux', os.arch: 'amd64', os.version: '4.9.184-linuxkit', java.version: '1.8.0_222'


Driver info: driver.version: FirefoxDriver


  at com.crawljax.di.ConfigurationModule.configure(ConfigurationModule.java:47)


  while locating com.crawljax.browser.EmbeddedBrowser


    for parameter 0 at com.crawljax.core.CrawlerContext.<init>(CrawlerContext.java:33)


  while locating com.crawljax.core.CrawlerContext


    for parameter 0 at com.crawljax.core.Crawler.<init>(Crawler.java:75)


  while locating com.crawljax.core.Crawler


    for parameter 2 at com.crawljax.core.CrawlTaskConsumer.<init>(CrawlTaskConsumer.java:30)


  while locating com.crawljax.core.CrawlTaskConsumer




1 error


        at com.google.inject.internal.InjectorImpl$4.get(InjectorImpl.java:987)


        at com.crawljax.core.CrawlController.call(CrawlController.java:66)


        at com.crawljax.core.CrawljaxRunner.call(CrawljaxRunner.java:37)


        at org.zaproxy.zap.extension.spiderAjax.SpiderThread.run(SpiderThread.java:257)


        at java.lang.Thread.run(Thread.java:748)


Caused by: org.openqa.selenium.WebDriverException: java.net.ConnectException: Failed to connect to localhost/127.0.0.1:9281


Build info: version: 'unknown', revision: 'unknown', time: 'unknown'


System info: host: '1b063d2841dd', ip: '172.17.0.2', os.name: 'Linux', os.arch: 'amd64', os.version: '4.9.184-linuxkit', java.version: '1.8.0_222'

Jyothsna L

unread,
Dec 16, 2019, 1:51:25 PM12/16/19
to OWASP ZAP User Group

thc...@gmail.com

unread,
Dec 16, 2019, 2:09:13 PM12/16/19
to zaprox...@googlegroups.com
This (Issue 5763) is fixed in the latest version of WebDriver add-ons,
which are bundled in latest weekly image (2019-12-16).

Best regards.

Jyothsna L

unread,
Dec 16, 2019, 7:10:40 PM12/16/19
to OWASP ZAP User Group
Thanks, it works now!
Reply all
Reply to author
Forward
0 new messages