search

OWASP / glue

Application Security Automation
Other
522 stars 112 forks source link

ZAP failing with: Supported versions = 2.4.0 and up - got 2.8.0 #161

Open hazana opened 5 years ago

hazana commented 5 years ago

For both docker and installed glue fails to use ZAP:

~# docker run --network="host" owasp/glue -t zap --zap-host http://127.0.0.1 --zap-port 8080 http://127.0.0.1:3000
Loading scanner...
Logfile nil?
calling scan
Running scanner
Mounting http://127.0.0.1:3000 with #<Glue::URLMounter:0x000000025f0198>
Mounted http://127.0.0.1:3000 with #<Glue::URLMounter:0x000000025f0198>
Processing target...http://127.0.0.1:3000
Running tasks in stage: wait
Running tasks in stage: mount
Running tasks in stage: file
Running tasks in stage: code
Running tasks in stage: live
Install ZAP from owasp.org and ensure that the configuration to connect is correct.  Supported versions = 2.4.0 and up - got 2.8.0
Running tasks in stage: done
Running base report...

~/glue# ruby bin/glue -t zap --zap-host http://localhost --zap-port 8080 http://localhost:3000
Logfile nil?
calling scan
Running scanner
Loading scanner...
Mounting http://127.0.0.1:3000 with #<Glue::URLMounter:0x000055ea8d0de2b0>
Mounted http://127.0.0.1:3000 with #<Glue::URLMounter:0x000055ea8d0de2b0>
Processing target...http://127.0.0.1:3000
Running tasks in stage: wait
Running tasks in stage: mount
Running tasks in stage: file
Running tasks in stage: code
Running tasks in stage: live
Install ZAP from owasp.org and ensure that the configuration to connect is correct.  Supported versions = 2.4.0 and up - got 2.8.0
Running tasks in stage: done
Running base report...
omerlh commented 5 years ago

Yes, look like we're not supporting 2.8 yet. I guess due to zaproxy/zaproxy#5162 we need to change the code a bit. I'm not sure I'll do it as I think using the dynamic task is better. See the docs here for details on how to use it.

hazana commented 5 years ago

@omerlh What are the advantages of the dynamic task if Glue is being used to run the series of tools and having it send the reports to a seperate defect tracker?

omerlh commented 5 years ago

In this case, it will not be useful. The dynamic task makes it easier to integrate tools into Glue, and make it easier to update it when the external tool is changed. If you do not wish to use it, it requires a small change in the code - I might be able to do it later on this week. If you'll have time, a PR is appreciated - and I can guide you.

stale[bot] commented 5 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.