Using OWASP through cmd-line

[Sai Theja Pamarty]

Hi,

I'm trying to use ZAP through cmd-line. My goal is to automate it through Azure DevOps, using only on-premise software. I'm won't be able to access GUI of ZAP 2.12.0. My system information is below,

ZAP Version: 2.12.0

Java Version: OpenJDK version "11.0.17" 2022-10-18 LTS

Environment: Linux 3.10.0-1160.80.1.0.1.el7.x86_64 (Remote server)(I'm accessing this through WinScp)

I've tried to run the below cmd,

/ZaProxy/ZAP_2.12.0/zap.sh -addonupdate -addoninstall report -dir /ZaProxy/directory -cmd

But I'm getting the following errors,

 [main ] INFO  GuiBootstrap - OWASP ZAP 2.12.0 started 20/01/2023, 08:46:27 with home 

[main ] FATAL GuiBootstrap - ZAP GUI is not supported on a headless environment.

Run ZAP inline or in daemon mode, use -help command line argument for more details.

 [main ] INFO  CommandLineBootstrap - OWASP ZAP 2.12.0 started 20/01/2023, 08:46:41 with home

[main ] ERROR CommandLine - No check for updates for over 3 month - add-ons may well be out of date

[main ] INFO  VersionPrinter - Flyway Community Edition 9.4.0 by Redgate

[main ] INFO  VersionPrinter -

[main ] INFO  BaseDatabaseType - Database: jdbc:hsqldb:file:/ZaProxy/directory/db/permanent (HSQL Database Engine 2.7)

[main ] WARN  Database - Flyway upgrade recommended: HSQLDB 2.7 is newer than this version of Flyway and support has not been tested. The latest supported version of HSQLDB is 2.6.

[main ] INFO  DbValidate - Successfully validated 1 migration (execution time 00:00.009s)
[main ] INFO  JdbcTableSchemaHistory - Creating Schema History table "PUBLIC"."flyway_schema_history" ...
[main ] INFO  DbMigrate - Current version of schema "PUBLIC": << Empty Schema >>
[main ] INFO  DbMigrate - Migrating schema "PUBLIC" to version "1 - Create table boast"
[main ] INFO  DbMigrate - Successfully applied 1 migration to schema "PUBLIC", now at version v1 (execution time 00:00.016s)
[main ] INFO  CallbackService - Started callback service on 0.0.0.0:40815
[main ] INFO  ExtensionNetwork - Creating new root CA certificate.
[main ] INFO  ExtensionNetwork - New root CA certificate created.

[ZAP-cfu] ERROR ExtensionCallHome - Connect to https://cfu.zaproxy.org:443 [cfu.zaproxy.org/172.67.129.53, cfu.zaproxy.org/104.21.1.121] failed: connect timed out
org.zaproxy.addon.network.common.ZapSocketTimeoutException: Connect to https://cfu.zaproxy.org:443 [cfu.zaproxy.org/172.67.129.53, cfu.zaproxy.org/104.21.1.121] failed: connect timed out
    at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:300) ~[?:?]
    at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:103) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAuthenticated(BaseHttpSender.java:298) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendNoRedirections(BaseHttpSender.java:266) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.send(BaseHttpSender.java:222) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:193) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:57) ~[?:?]
    at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:478) ~[zap-2.12.0.jar:2.12.0]
    at org.zaproxy.addon.callhome.ExtensionCallHome.sendServiceRequest(ExtensionCallHome.java:211) ~[?:?]
    at org.zaproxy.addon.callhome.ExtensionCallHome.getServiceData(ExtensionCallHome.java:230) ~[?:?]
    at org.zaproxy.addon.callhome.ExtensionCallHome.getCheckForUpdatesData(ExtensionCallHome.java:239) ~[?:?]
    at org.zaproxy.addon.callhome.ExtensionCallHome.get(ExtensionCallHome.java:249) ~[?:?]
    at org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate.getRemoteConfiguration(ExtensionAutoUpdate.java:991) ~[zap-2.12.0.jar:2.12.0]
    at org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate$4.run(ExtensionAutoUpdate.java:1119) ~[zap-2.12.0.jar:2.12.0]

[main ] ERROR CommandLine - Check for updates call failed

[ZAP-cfu] ERROR ExtensionCallHome - Connect to https://cfu.zaproxy.org:443 [cfu.zaproxy.org/104.21.1.121, cfu.zaproxy.org/172.67.129.53] failed: connect timed out
org.zaproxy.addon.network.common.ZapSocketTimeoutException: Connect to https://cfu.zaproxy.org:443 [cfu.zaproxy.org/104.21.1.121, cfu.zaproxy.org/172.67.129.53] failed: connect timed out
    at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:300) ~[?:?]
    at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:103) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAuthenticated(BaseHttpSender.java:298) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendNoRedirections(BaseHttpSender.java:266) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.send(BaseHttpSender.java:222) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:193) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:57) ~[?:?]
    at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:478) ~[zap-2.12.0.jar:2.12.0]
    at org.zaproxy.addon.callhome.ExtensionCallHome.sendServiceRequest(ExtensionCallHome.java:211) ~[?:?]
    at org.zaproxy.addon.callhome.ExtensionCallHome.getServiceData(ExtensionCallHome.java:230) ~[?:?]
    at org.zaproxy.addon.callhome.ExtensionCallHome.getCheckForUpdatesData(ExtensionCallHome.java:239) ~[?:?]
    at org.zaproxy.addon.callhome.ExtensionCallHome.get(ExtensionCallHome.java:249) ~[?:?]
    at org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate.getRemoteConfiguration(ExtensionAutoUpdate.java:991) ~[zap-2.12.0.jar:2.12.0]
    at org.zaproxy.zap.extension.autoupdate.ExtensionAutoUpdate$4.run(ExtensionAutoUpdate.java:1119) ~[zap-2.12.0.jar:2.12.0]

[main ] ERROR CommandLine - Check for updates call failed

[main ] WARN  ExtensionNetwork - Failed to start the main proxy: java.net.BindException Address already in use

[main ] ERROR CommandLine - Terminating ZAP, unable to start the main proxy.

[ZAP-telemetry-start] ERROR ExtensionCallHome - Connect to https://tel.zaproxy.org:443 [tel.zaproxy.org/172.67.129.53, tel.zaproxy.org/104.21.1.121] failed: connect timed out
org.zaproxy.addon.network.common.ZapSocketTimeoutException: Connect to https://tel.zaproxy.org:443 [tel.zaproxy.org/172.67.129.53, tel.zaproxy.org/104.21.1.121] failed: connect timed out
    at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:300) ~[?:?]
    at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:103) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAuthenticated(BaseHttpSender.java:298) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendNoRedirections(BaseHttpSender.java:266) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.send(BaseHttpSender.java:222) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:193) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:57) ~[?:?]
    at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:478) ~[zap-2.12.0.jar:2.12.0]
    at org.zaproxy.addon.callhome.ExtensionCallHome.sendServiceRequest(ExtensionCallHome.java:211) ~[?:?]
    at org.zaproxy.addon.callhome.ExtensionCallHome.lambda$uploadTelemetryStartData$5(ExtensionCallHome.java:339) ~[?:?]
    at java.lang.Thread.run(Thread.java:829) ~[?:?]
2023-01-20 08:48:47,854 [main ] ERROR ExtensionCallHome - Connect to https://tel.zaproxy.org:443 [tel.zaproxy.org/172.67.129.53, tel.zaproxy.org/104.21.1.121] failed: connect timed out
org.zaproxy.addon.network.common.ZapSocketTimeoutException: Connect to https://tel.zaproxy.org:443 [tel.zaproxy.org/172.67.129.53, tel.zaproxy.org/104.21.1.121] failed: connect timed out
    at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:300) ~[?:?]
    at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:103) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAuthenticated(BaseHttpSender.java:298) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendNoRedirections(BaseHttpSender.java:266) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.send(BaseHttpSender.java:222) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:193) ~[?:?]
    at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:57) ~[?:?]
    at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:478) ~[zap-2.12.0.jar:2.12.0]
    at org.zaproxy.addon.callhome.ExtensionCallHome.sendServiceRequest(ExtensionCallHome.java:211) ~[?:?]
    at org.zaproxy.addon.callhome.ExtensionCallHome.uploadTelemetrySessionData(ExtensionCallHome.java:360) ~[?:?]
    at org.zaproxy.addon.callhome.ExtensionCallHome.destroy(ExtensionCallHome.java:454) ~[?:?]
    at org.parosproxy.paros.extension.ExtensionLoader.destroyAllExtension(ExtensionLoader.java:186) ~[zap-2.12.0.jar:2.12.0]
    at org.parosproxy.paros.control.AbstractControl.shutdown(AbstractControl.java:72) ~[zap-2.12.0.jar:2.12.0]
    at org.parosproxy.paros.control.Control.shutdown(Control.java:228) ~[zap-2.12.0.jar:2.12.0]
    at org.zaproxy.zap.CommandLineBootstrap.start(CommandLineBootstrap.java:114) ~[zap-2.12.0.jar:2.12.0]
    at org.zaproxy.zap.ZAP.main(ZAP.java:94) ~[zap-2.12.0.jar:2.12.0]
2023-01-20 08:48:51,993 [main ] INFO  CommandLineBootstrap - OWASP ZAP 2.12.0 terminated.

What should I do next?

Thanks & Regards

Sai Theja Pamarty

[Simon Bennetts]

Hiya,

There are a several things of things going on here.

1. You are trying to use the GUI in a headless environment: "FATAL GuiBootstrap - ZAP GUI is not supported on a headless environment."

The automation options are detailed on https://www.zaproxy.org/docs/automate/

However you may well find it easier to test ZAP with your apps on another machine where you can use the ZAP GUI - that way you can check everything is working well before you automate it.

2. "Failed to start the main proxy: java.net.BindException Address already in use" - this means that something else is already listenning on the default ZAP port (8080).

You can change whatever is listenning on that port, but its probably easier to get ZAP to listen on a different port.

You can do that using the command line e.g. "-port 8090"

3. ZAP cannot connect to any of the ZAP services: "ERROR ExtensionCallHome - Connect to https://cfu.zaproxy.org:443 [cfu.zaproxy.org/172.67.129.53, cfu.zaproxy.org/104.21.1.121] failed: connect timed out"

This means that ZAP will not be able to update existing add-ons or install new ones.

Do you have internet access from the machine running ZAP?

Do you need to use a proxy to access the internet?

Cheers,

Simon

[Sai Theja Pamarty]

Hi, 

1 and 2 errors are cleared. Regarding the third one.
We've to use proxy.

Thanks & Regards
Sai Theja pamarty

[Sai Theja Pamarty]

Hi,

Is there any way to give a proxy or pass a proxy while running it through the cmd line? or do we've to add URLs to a proxy list or something...

https://tel.zaproxy.org:443 This is also popping up in error with https://cfu.zaproxy.org:443

I also have a problem with -daemon mode. It does work the same as -cmd mode except showing the log on cli. But it never ends, even after the execution of the cmd I've given. It does scan and generates reports.

85471 [ZAP-telemetry-start] ERROR org.zaproxy.addon.callhome.ExtensionCallHome - Connect to https://tel.zaproxy.org:443 [tel.zaproxy.org/172.67.129.53, tel.zaproxy.org/104.21.1.121] failed: connect timed out

org.zaproxy.addon.network.common.ZapSocketTimeoutException: Connect to https://tel.zaproxy.org:443 [tel.zaproxy.org/172.67.129.53, tel.zaproxy.org/104.21.1.121] failed: connect timed out
        at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:300) ~[?:?]
        at org.zaproxy.addon.network.internal.client.apachev5.HttpSenderApache.sendImpl(HttpSenderApache.java:103) ~[?:?]
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAuthenticated(BaseHttpSender.java:298) ~[?:?]
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendNoRedirections(BaseHttpSender.java:266) ~[?:?]
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.send(BaseHttpSender.java:222) ~[?:?]
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:193) ~[?:?]
        at org.zaproxy.addon.network.internal.client.BaseHttpSender.sendAndReceive(BaseHttpSender.java:57) ~[?:?]
        at org.parosproxy.paros.network.HttpSender.sendAndReceive(HttpSender.java:478) ~[zap-2.12.0.jar:2.12.0]
        at org.zaproxy.addon.callhome.ExtensionCallHome.sendServiceRequest(ExtensionCallHome.java:211) ~[?:?]
        at org.zaproxy.addon.callhome.ExtensionCallHome.lambda$uploadTelemetryStartData$5(ExtensionCallHome.java:339) ~[?:?]
        at java.lang.Thread.run(Thread.java:829) ~[?:?]

This is the message it's stuck at. I always have to end it through Ctrl+C.

Thanks & Regards
Sai Theja Pamarty

[Sai Theja Pamarty]

Hi, 

I've tried the config file, I'm getting the following error.

Unexpected error accessing file /config.yaml : The starting URI does not belong to the context: http://exampl.com/app?WSDL - see log for details

When I'm trying to give the -dir option it does not recognize the -autorun option. where is the default log location?

Thanks & Regards

Sai Theja Pamarty