Two question about ZAP API

[洪嘉佑]

Question 1
How can I get only passive scanning results or active scanning results by using the  GET /JSON/core/view/alerts/   endpoint? 

Question 2
I've used  GET /JSON/ascan/view/scanPolicyNames endpoint to get the scanPolicyNames and I only get "Default Policy", can I use any API endpoint to import more policies? 

[Simon Bennetts]

Replies inline:

On Tuesday, 28 March 2023 at 09:15:45 UTC+1 irving...@gmail.com wrote:

Question 1
How can I get only passive scanning results or active scanning results by using the  GET /JSON/core/view/alerts/   endpoint?

You cant.

You can either:

• Call that endpoint after the passive scan queue has been empties and before you start an active scan
• Retrieve all of the alerts and then filter them locally using the sourceid - search for a type of "Alert Source" on https://www.zaproxy.org/docs/constants/ to see the possible values
  

 

Question 2
I've used  GET /JSON/ascan/view/scanPolicyNames endpoint to get the scanPolicyNames and I only get "Default Policy", can I use any API endpoint to import more policies? 

Yes:  /JSON/ascan/action/importScanPolicy

Cheers,

Simon

[洪嘉佑]

Hi,

Replies to Q1:

I've used  GET /JSON/spider/action/scan/ to start a spider scanning . After the spider scanning finished, I used    GET /JSON/core/view/alerts/
to get the alert information but it says that there is no alert being raised. 
It replies like this:

{

"alerts": []

} I'd like to know why this happened and how can I make it works

Replies to Q2:
The document (https://www.zaproxy.org/docs/api/#ascanactionimportscanpolicy) indicates that  GET /JSON/ascan/action/importScanPolicy/
endpoint requires a query parameter "path, which is a file system path. 

So does it mean I need to get an policy file online and install it on my local machine or I can get those files through zap ? 


Thanks for your replying 

---------- Forwarded message ---------
寄件者： Simon Bennetts <psi...@gmail.com>
Date: 2023年3月28日 週二 下午4:34
Subject: [zaproxy-users] Re: Two question about ZAP API
To: OWASP ZAP User Group <zaprox...@googlegroups.com>

--
You received this message because you are subscribed to the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/adb92c31-217a-489a-8d86-a36592d4ab43n%40googlegroups.com.

[Simon Bennetts]

Have you waited for the passive scan queue to empty?

The policy file needs to be locally accessible.

FYI you may find the Automation Framework an easier option for automating ZAP: https://www.zaproxy.org/docs/automate/automation-framework/

Cheers,

Simon

[洪嘉佑]

Dear Simon:

Replied to Q1 :

Yes I have used endpoint JSON/pscan/view/recordsToScan to check that there are no  records the passive scanner still has to scan by showing 

{

"recordsToScan": "0"

}

Replied to Q2:
Does zap's  Github repository provide some download links of scan policies?


Thanks for your replying 

Simon Bennetts <psi...@gmail.com> 於 2023年3月31日 週五 下午6:49寫道：

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/40feb2cf-76e7-4eb2-bae1-9b068d4e2174n%40googlegroups.com.