Automating AJAX Spider

[bclark]

Hi,

I have been trying to accomplish the task of automating ZAP to test my web application. As I started this process, everything went well until I got to the AJAX Spider.

 
Process: I go to add job, click spiderAjax, add Default Context, select the URL I want to attack, show advanced options and select Chrome as the Browser Id and hit save. 

Results: No chrome window shows when the job is started. When the automation gets to the AJAX job, it will have a yellow circle, status: running, and info OK: []. It never gets past this job. When I run a regular spider after some time, the status goes to OK and the info shows the job completed. 

I have tried some different approaches with my website and also attacking the Juice Shop and have gotten the same results. My overall question would be why does the AJAX not produce any results when ran in automation? Along with why is the AJAX not producing a window showing the process of the spider in automation like it does outside automation? 
Thanks for taking the time to help. 

[kingthorin+owaspzap]

OWASP ZAP – Somethings not working. What should I do? (zaproxy.org)

[bclark]

Thanks for the quick response. 

I have already been to that page and came to the user group page. 

[kingthorin+owaspzap]

So what was in the log file ?

What version of Chrome do you have installed?

What platform?
What version of Java?

[bclark]

The error showing - [ZAP-Automation] ERROR UncaughtExceptionLogger - Exception in thread "ZAP-Automation"
java.lang.IllegalStateException: The starting URI does not belong to the context: 

ZAP - 2.11.1

Chrome - 105.0.5195.127

Platform - Windows 10

Java - 1.8.0_332

[kingthorin+owaspzap]

"The starting URI does not belong to the context" seems to sum it up pretty clearly.

[bclark]

More on the error, if I remove the selected URL, AJAX will finish but with 0 URLs found and the Chrome window is still not opening. If I keep the URL selected, this error shows. 

[Simon Bennetts]

I think that is a bug that should be fixed in the latest Ajax Spider release (last Friday).

Can you make sure you have this version and try again?

Cheers,

Simon

[bclark]

Hi guys, 

I have updated to the newest version and have tried rerunning all of the automation. I still am having no luck with the AJAX spider. I am stuck and am confused on what I am doing wrong. 

If I right click on the URL I am attacking under 'sites' and use the AJAX spider, it brings up the Chrome Window, runs for whatever amount of time and finds so many URLs. It works fine. 

I then clear the session, open the 'Automation' tab, add the default context, add a spiderAjax job, add the deafult context to that and hit the run button. The spiderAjax job finds no URLs and doesn't bring up a window. 

Is there something I am missing for it to run correctly? I have had success with the automation of active scan and the regular spider but it seems that I just can't get the spiderAjax. 

I appreciate you both taking the time to help, 

Brody 

[Simon Bennetts]

Have you updated all of the add-ons?

If not then do that because I know a couple of bugs were fixed in the Ajax Spider one.

If it still doesnt work then check the zap.log file: https://www.zaproxy.org/faq/somethings-not-working-what-should-i-do/#check-the-log-file

Cheers,

Simon

[bclark]

The add-ons seem to be what I was missing. 

Thank you for taking the time to help and have a great weekend,

Brody