iriusrisk / bdd-security

BDD Automated Security Tests for Web Applications
http://www.continuumsecurity.net/bdd-intro.html
GNU Affero General Public License v3.0
559 stars 178 forks source link

Connection refused #46

Open lfatty opened 8 years ago

lfatty commented 8 years ago

Any idea why am I seeing this error.

net.continuumsecurity.proxy.ProxyException: org.zaproxy.clientapi.core.ClientApiException: java.net.ConnectException: Connection refused at net.continuumsecurity.proxy.ZAProxyScanner.validateMinimumRequiredZapVersion(ZAProxyScanner.java:112) at net.continuumsecurity.proxy.ZAProxyScanner.(ZAProxyScanner.java:54) at net.continuumsecurity.steps.AppScanningSteps.getScanner(AppScanningSteps.java:81) at net.continuumsecurity.steps.AppScanningSteps.disableAllScanners(AppScanningSteps.java:76) at ✽.And a scanner with all policies disabled(app_scan.feature:7) Caused by: org.zaproxy.clientapi.core.ClientApiException: java.net.ConnectException: Connection refused at org.zaproxy.clientapi.core.ClientApi.callApiDom(Unknown Source) at org.zaproxy.clientapi.core.ClientApi.callApi(Unknown Source) at org.zaproxy.clientapi.gen.Core.version(Unknown Source) at net.continuumsecurity.proxy.ZAProxyScanner.validateMinimumRequiredZapVersion(ZAProxyScanner.java:101) at net.continuumsecurity.proxy.ZAProxyScanner.(ZAProxyScanner.java:54) at net.continuumsecurity.steps.AppScanningSteps.getScanner(AppScanningSteps.java:81) at net.continuumsecurity.steps.AppScanningSteps.disableAllScanners(AppScanningSteps.java:76) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at cucumber.runtime.Utils$1.call(Utils.java:37) at cucumber.runtime.Timeout.timeout(Timeout.java:13) at cucumber.runtime.Utils.invoke(Utils.java:31) at cucumber.runtime.java.JavaStepDefinition.execute(JavaStepDefinition.java:38) at cucumber.runtime.StepDefinitionMatch.runStep(StepDefinitionMatch.java:37) at cucumber.runtime.Runtime.runStep(Runtime.java:299) at cucumber.runtime.model.StepContainer.runStep(StepContainer.java:44) at cucumber.runtime.model.StepContainer.runSteps(StepContainer.java:39) at cucumber.runtime.model.CucumberScenario.runBackground(CucumberScenario.java:59) at cucumber.runtime.model.CucumberScenario.run(CucumberScenario.java:42) at cucumber.runtime.junit.ExecutionUnitRunner.run(ExecutionUnitRunner.java:91) at cucumber.runtime.junit.FeatureRunner.runChild(FeatureRunner.java:63) at cucumber.runtime.junit.FeatureRunner.runChild(FeatureRunner.java:18) at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238) at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63) at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236) at org.junit.runners.ParentRunner.access$000(ParentRunner.java:53) at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229) at org.junit.runners.ParentRunner.run(ParentRunner.java:309) at cucumber.runtime.junit.FeatureRunner.run(FeatureRunner.java:70) at cucumber.api.junit.Cucumber.runChild(Cucumber.java:93) at cucumber.api.junit.Cucumber.runChild(Cucumber.java:37) at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238) at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63) at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236) at org.junit.runners.ParentRunner.access$000(ParentRunner.java:53) at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229) at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27) at org.junit.runners.ParentRunner.run(ParentRunner.java:309) at cucumber.api.junit.Cucumber.run(Cucumber.java:98) at org.gradle.api.internal.tasks.testing.junit.JUnitTestClassExecuter.runTestClass(JUnitTestClassExecuter.java:105) at org.gradle.api.internal.tasks.testing.junit.JUnitTestClassExecuter.execute(JUnitTestClassExecuter.java:56) at org.gradle.api.internal.tasks.testing.junit.JUnitTestClassProcessor.processTestClass(JUnitTestClassProcessor.java:64) at org.gradle.api.internal.tasks.testing.SuiteTestClassProcessor.processTestClass(SuiteTestClassProcessor.java:50) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:35) at org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:24) at org.gradle.messaging.dispatch.ContextClassLoaderDispatch.dispatch(ContextClassLoaderDispatch.java:32) at org.gradle.messaging.dispatch.ProxyDispatchAdapter$DispatchingInvocationHandler.invoke(ProxyDispatchAdapter.java:93) at com.sun.proxy.$Proxy2.processTestClass(Unknown Source) at org.gradle.api.internal.tasks.testing.worker.TestWorker.processTestClass(TestWorker.java:106) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:35) at org.gradle.messaging.dispatch.ReflectionDispatch.dispatch(ReflectionDispatch.java:24) at org.gradle.messaging.remote.internal.hub.MessageHub$Handler.run(MessageHub.java:360) at org.gradle.internal.concurrent.ExecutorPolicy$CatchAndRecordFailures.onExecute(ExecutorPolicy.java:54) at org.gradle.internal.concurrent.StoppableExecutorImpl$1.run(StoppableExecutorImpl.java:40) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.net.ConnectException: Connection refused at java.net.PlainSocketImpl.socketConnect(Native Method) at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) at java.net.Socket.connect(Socket.java:589) at java.net.Socket.connect(Socket.java:538) at sun.net.NetworkClient.doConnect(NetworkClient.java:180) at sun.net.www.http.HttpClient.openServer(HttpClient.java:432) at sun.net.www.http.HttpClient$1.run(HttpClient.java:484) at sun.net.www.http.HttpClient$1.run(HttpClient.java:482) at java.security.AccessController.doPrivileged(Native Method) at sun.net.www.http.HttpClient.privilegedOpenServer(HttpClient.java:481) at sun.net.www.http.HttpClient.openServer(HttpClient.java:522) at sun.net.www.http.HttpClient.(HttpClient.java:211) at sun.net.www.http.HttpClient.New(HttpClient.java:308) at sun.net.www.http.HttpClient.New(HttpClient.java:326) at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(HttpURLConnection.java:1169) at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1148) at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:999) at sun.net.www.protocol.http.HttpURLConnection.connect(HttpURLConnection.java:933) at org.zaproxy.clientapi.core.ClientApi.getConnectionInputStream(Unknown Source) ... 67 more

dmettem commented 8 years ago

This error is when you use an older version of ZAP than what is expected. I guess, the minimum version to be used now is ZAP 2.4.3.

lfatty commented 8 years ago

@dmettem I do not think so because I am running the default zap which comes with the framework.

iriusrisk commented 8 years ago

Before that output there is an additional INFO log stating the port that ZAP is listening on:

4835 [ZAP-daemon] INFO org.zaproxy.zap.DaemonBootstrap - ZAP is now listening on 127.0.0.1:55759

Can you start the framework up in a debugger and then put a breakpoint just before the first API call to ZAP? Then you can manually make a connection to the ZAP port to verify that it is listening.

iriusrisk commented 8 years ago

Did you resolve this problem @lfatty ?

lfatty commented 8 years ago

@continuumsecurity, I increased CONNECTION_TIMEOUT = 150000; //milliseconds. So far it seems to be working fine but i will keep eyes on it.