Script comunication with the alert object

[märio liny]

Hi zaproxy Team,

first, thanks for the work you put into it, zaproxy has evolved a lot during the last years!

I've a question about scripting.

I want to be able to right click on a raised alert, and then print the result in the script console.

While the answer here https://stackoverflow.com/questions/49167651/can-i-access-to-alerts-object-of-owasp-zap works perfectly when printing details on all alarms, i'm trying to limit the results only on the alarm i'm right clicking on.

Does it make sense?

Is this possible?

Thanks again, and keep up the great work you're doing

Cristian

[Simon Bennetts]

Hi Cristian,

You can right click on URLs and run a script using Targeted Scripts. However these only work for URLs and not alerts :/

In theory we could extend them to support alerts as well, but that will take a bit of work and wouldn't be available until 2.12 at the earliest.

You will be able to do this using Extender Scripts but we dont appear to have any examples right now :/

In Java you can add a popup menu item to alerts by extending PopupMenuItemAlert - if you're comfortable reading Java then have a look at the classes which extend this and see if you can convert that code into one of the supported scripting languages. It will work but might take a bit of messing around.

Cheers,

Simon

[märio liny]

Thanks Simon,

I'm using Extender scripts, and "copy as curl command menu.js" as template.

I came up with this, but of course it gets only the first alert in the list (alerts[0]):

var popupmenuitemtype = Java.type("org.zaproxy.zap.view.popup.PopupMenuItemHistoryReferenceContainer");
var alertdet= new popupmenuitemtype("Get Alert Detail") {
    performAction: function(href) {
        invokeWith(href.getHttpMessage());
    }
}

function install(helper) {
    if (helper.getView()) {
        helper.getView().getPopupMenu().addMenu(alertdet);
    }
}

function uninstall(helper) {
  if (helper.getView()) {
    helper.getView().getPopupMenu().removeMenu(alertdet);
  }
}

function invokeWith(msg) {

    extAlert = org.parosproxy.paros.control.Control.getSingleton().getExtensionLoader().getExtension(org.zaproxy.zap.extension.alert.ExtensionAlert.NAME)
    var Alert = org.parosproxy.paros.core.scanner.Alert;
var alerts = extAlert.getAllAlerts()
     var alert = alerts[0]
    print(alert.uri)
    print(alert.name)
}

Cristian

[kingthorin+owaspzap]

You'd have to get the alerts tree and see what's selected then only print the details for the selected items as you walk the tree.

[märio liny]

Hi

any idea on how i can achieve that?

I'm reading all the possible JS/java code out there but still can't find what i should call.

Any help is very appreciated.

Cristian

[kingthorin+owaspzap]

Have a look at this code: It's used for counted selected alerts, so you could do basically the same thing but instead of counting get the alert and output the details:

https://github.com/zaproxy/zaproxy/blob/8ac4b10d3d9d816957985694c2b7cf127d1364d3/zap/src/main/java/org/zaproxy/zap/extension/alert/PopupMenuItemAlert.java#L175-L202

[kingthorin+owaspzap]

counted > counting

[märio liny]

Hi again guys,

still struggling with this one.

Now i'm trying to use javax.swing.JTree to access the tree, but seems i'm not able to do that properly

function invokeWith(msg) {
    extAlert = org.parosproxy.paros.control.Control.getSingleton().getExtensionLoader().getExtension(org.zaproxy.zap.extension.alert.ExtensionAlert.NAME)

    var Alert = org.zaproxy.zap.extension.alert;
var JTree = Java.type("javax.swing.JTree");
var  tree = new(JTree);
print(tree)

}

output:

javax.swing.JTree[,0,0,0x0,invalid,alignmentX=0.0,alignmentY=0.0,border=com.formdev.flatlaf.ui.FlatEmptyBorder@75cfc82a,flags=16777576,maximumSize=,minimumSize=,preferredSize=,editable=false,invokesStopCellEditing=false,largeModel=false,rootVisible=true,rowHeight=0,scrollsOnExpand=true,showsRootHandles=false,toggleClickCount=2,visibleRowCount=20]

Not sure i shall try to convert JTree treeAlert = this.extAlert.getAlertPanel().getTreeAlert(); to JS somehow.

I'm completely lost.

Cristian

[kingthorin+owaspzap]

Try:

    extAlert = org.parosproxy.paros.control.Control.getSingleton().getExtensionLoader().getExtension(org.zaproxy.zap.extension.alert.ExtensionAlert.class)

[kingthorin+owaspzap]

And Alert should be a Java.type