Get error "Exception in thread "main" org.zaproxy.clientapi.core.ClientApiException: Does Not Exist" in form authentication:

[Arpit]

Exception in thread "main" org.zaproxy.clientapi.core.ClientApiException: Does Not Exist

at org.zaproxy.clientapi.core.ApiResponseFactory.getResponse(ApiResponseFactory.java:50)

at org.zaproxy.clientapi.core.ClientApi.callApi(ClientApi.java:351)

at org.zaproxy.clientapi.gen.Context.includeInContext(Context.java:106)

at FormAuth.setIncludeAndExcludeInContext(FormAuth.java:24)

at FormAuth.main(FormAuth.java:107)

========================================================================

import org.zaproxy.clientapi.core.ApiResponse;
import org.zaproxy.clientapi.core.ApiResponseElement;
import org.zaproxy.clientapi.core.ClientApi;
import org.zaproxy.clientapi.core.ClientApiException;

import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;

public class FormAuth {

private static final String ZAP_ADDRESS = Global.ZAP_ADDRESS;
private static final int ZAP_PORT = Global.ZAP_PORT;
// Change to match the API key set in ZAP, or use NULL if the API key is disabled
private static final String ZAP_API_KEY = Global.ZAP_API_KEY;
// The URL of the application to be tested
private static final String target = Global.TARGET;
private static final String contextId = "1";
private static final String contextName = "Default Context";

private static void setIncludeAndExcludeInContext(ClientApi clientApi) throws UnsupportedEncodingException, ClientApiException {
String includeInContext = "http://localhost:8090/bodgeit.*";
String excludeInContext = "http://localhost:8090/bodgeit/logout.jsp";

clientApi.context.includeInContext(contextName, includeInContext);
clientApi.context.excludeFromContext(contextName, excludeInContext);
}

private static void setLoggedInIndicator(ClientApi clientApi) throws UnsupportedEncodingException, ClientApiException {
// Prepare values to set, with the logged in indicator as a regex matching the logout link
String loggedInIndicator = "<a href=\"logout.jsp\">Logout</a>";

// Actually set the logged in indicator
clientApi.authentication.setLoggedInIndicator(contextId, java.util.regex.Pattern.quote(loggedInIndicator));

// Check out the logged in indicator that is set
System.out.println("Configured logged in indicator regex: "
+ ((ApiResponseElement) clientApi.authentication.getLoggedInIndicator(contextId)).getValue());
}

private static void setFormBasedAuthenticationForBodgeit(ClientApi clientApi) throws ClientApiException,
UnsupportedEncodingException {
// Setup the authentication method

String loginUrl = "http://localhost:8090/bodgeit/login.jsp";
String loginRequestData = "username={%username%}&password={%password%}";

// Prepare the configuration in a format similar to how URL parameters are formed. This
// means that any value we add for the configuration values has to be URL encoded.
StringBuilder formBasedConfig = new StringBuilder();
formBasedConfig.append("loginUrl=").append(URLEncoder.encode(loginUrl, "UTF-8"));
formBasedConfig.append("&loginRequestData=").append(URLEncoder.encode(loginRequestData, "UTF-8"));

System.out.println("Setting form based authentication configuration as: "
+ formBasedConfig.toString());
clientApi.authentication.setAuthenticationMethod(contextId, "formBasedAuthentication",
formBasedConfig.toString());

// Check if everything is set up ok
System.out
.println("Authentication config: " + clientApi.authentication.getAuthenticationMethod(contextId).toString(0));
}

private static String setUserAuthConfigForBodgeit(ClientApi clientApi) throws ClientApiException, UnsupportedEncodingException {
// Prepare info
String user = "Test User";
String username = "te...@gmail.com";
String password = "weakPass";

// Make sure we have at least one user
String userId = extractUserId(clientApi.users.newUser(contextId, user));

// Prepare the configuration in a format similar to how URL parameters are formed. This
// means that any value we add for the configuration values has to be URL encoded.
StringBuilder userAuthConfig = new StringBuilder();
userAuthConfig.append("username=").append(URLEncoder.encode(username, "UTF-8"));
userAuthConfig.append("&password=").append(URLEncoder.encode(password, "UTF-8"));

System.out.println("Setting user authentication configuration as: " + userAuthConfig.toString());
clientApi.users.setAuthenticationCredentials(contextId, userId, userAuthConfig.toString());
clientApi.users.setUserEnabled(contextId, userId, "true");
clientApi.forcedUser.setForcedUser(contextId, userId);
clientApi.forcedUser.setForcedUserModeEnabled(true);

// Check if everything is set up ok
System.out.println("Authentication config: " + clientApi.users.getUserById(contextId, userId).toString(0));
return userId;
}

private static String extractUserId(ApiResponse response) {
return ((ApiResponseElement) response).getValue();
}

private static void scanAsUser(ClientApi clientApi, String userId) throws ClientApiException {
clientApi.spider.scanAsUser(contextId, userId, target, null, "true", null);
}

/**
* The main method.
*
* @param args the arguments
* @throws ClientApiException
* @throws UnsupportedEncodingException
*/
public static void main(String[] args) throws ClientApiException, UnsupportedEncodingException {
ClientApi clientApi = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

setIncludeAndExcludeInContext(clientApi);
setFormBasedAuthenticationForBodgeit(clientApi);
setLoggedInIndicator(clientApi);
String userId = setUserAuthConfigForBodgeit(clientApi);
scanAsUser(clientApi, userId);
}
}

https://www.zaproxy.org/docs/api/#getting-authenticated

[Arpit]

I am running the docker application using : sudo docker run --rm -p 8090:8080 -i -t psiinon/bodgeit

[Simon Bennetts]

You will be able to find more detail of what ZAP is complaining about in the zap.log file: https://www.zaproxy.org/faq/somethings-not-working-what-should-i-do/#check-the-log-file

In this case I suspect its because the "Default Context" probably doesnt exist.

Thats created by default when you use the ZAP desktop but I _think_ its not created when you run ZAP in daemon mode.

Cheers,

Simon

[Soju George]

Sure i will do that.. 

I was able to do it by running

zap-baseline.py -d -i -t $DAST_WEBSITE

Thanks for the help

---

From: zaprox...@googlegroups.com <zaprox...@googlegroups.com> on behalf of Simon Bennetts <psi...@gmail.com>
Sent: 28 September 2021 22:20
To: OWASP ZAP User Group <zaprox...@googlegroups.com>
Subject: [zaproxy-users] Re: Get error "Exception in thread "main" org.zaproxy.clientapi.core.ClientApiException: Does Not Exist" in form authentication:

 

Advertencia: Has recibido un correo externo. Recuerda no abrir links ni descargar archivos adjuntos que lleguen de remitentes desconocidos o de correos no solicitados.

--
You received this message because you are subscribed to the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/d35b588d-f234-4665-98f9-4bda5d38569en%40googlegroups.com.

Descarga de Responsabilidad:

Este mensaje contiene información confidencial y esta dirigido solamente al remitente especificado. Si usted no es el destinatario no debe tener acceso, distribuir ni copiar este e-mail. Notifique por favor al remitente inmediatamente si usted ha recibido este mensaje por error y eliminelo de su sistema. La transmisión del e-mail no se puede garantizar que sea segura, sin errores o como que la información podría ser interceptada, alterada, perdida, destruida, llegar atrasado, incompleto o contener virus, por lo tanto el remitente no acepta la responsabilidad por ningunos de los errores u omisiones en el contenido de este mensaje, que se presentan como resultado de la transmisión del e-mail. Si la verificación se requiere, por favor solicite una versión impresa.

Disclaimer:

This message contains confidential information and is intended only for recipient specified. If you are not recipient you should not disseminate, distribute or copy this e-mail. Please notify to sender immediately if you have received this message by mistake and delete this from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The receptor therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. If verification is required, please request a hard-copy version.

[Arpit]

Thanks!