API tools faq
paste
Advertisement
NaroxEG

web apps vulnerability auto-scan

NaroxEG
Dec 3rd, 2024
404
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 4.21 KB | None | 0 0
raw download clone embed print report
  1. import time
  2. from zapv2 import ZAPv2
  3.  
  4. class WebVulnerabilityScanner:
  5.     def __init__(self, target_url, zap_host='localhost', zap_port=8080):
  6.         """
  7.        Initialize the vulnerability scanner with ZAP proxy settings
  8.        
  9.        :param target_url: Full URL of the web application to scan
  10.        :param zap_host: ZAP proxy host (default: localhost)
  11.        :param zap_port: ZAP proxy port (default: 8080)
  12.        """
  13.         self.target_url = target_url
  14.         self.zap = ZAPv2(proxies={'http': f'http://{zap_host}:{zap_port}',
  15.                                   'https': f'http://{zap_host}:{zap_port}'})
  16.        
  17.     def configure_scan_settings(self):
  18.         """
  19.        Configure initial ZAP scan settings
  20.        """
  21.         # Disable popup warnings
  22.         self.zap.core.set_option_warn_on_new_alerts(False)
  23.        
  24.         # Set scan timeout
  25.         self.zap.core.set_option_scan_timeout(60)
  26.        
  27.         # Configure alert filters if needed
  28.         # self.zap.core.add_alert_filter()
  29.    
  30.     def start_spider_scan(self):
  31.         """
  32.        Perform spider (crawling) scan to discover web application structure
  33.        
  34.        :return: Scan ID for tracking progress
  35.        """
  36.         print(f"Starting spider scan on {self.target_url}")
  37.         scan_id = self.zap.spider.scan(self.target_url)
  38.        
  39.         # Wait for spider scan to complete
  40.         while int(self.zap.spider.status(scan_id)) < 100:
  41.             print(f"Spider scan progress: {self.zap.spider.status(scan_id)}%")
  42.             time.sleep(2)
  43.        
  44.         print("Spider scan completed")
  45.         return scan_id
  46.    
  47.     def start_active_scan(self):
  48.         """
  49.        Perform active vulnerability scanning
  50.        
  51.        :return: Scan ID for tracking progress
  52.        """
  53.         print(f"Starting active scan on {self.target_url}")
  54.         scan_id = self.zap.ascan.scan(self.target_url)
  55.        
  56.         # Wait for active scan to complete
  57.         while int(self.zap.ascan.status(scan_id)) < 100:
  58.             print(f"Active scan progress: {self.zap.ascan.status(scan_id)}%")
  59.             time.sleep(5)
  60.        
  61.         print("Active scan completed")
  62.         return scan_id
  63.    
  64.     def generate_report(self, output_file='zap_vulnerability_report.html'):
  65.         """
  66.        Generate HTML report of discovered vulnerabilities
  67.        
  68.        :param output_file: Path to save the report
  69.        """
  70.         print(f"Generating vulnerability report: {output_file}")
  71.         alerts = self.zap.core.alerts(baseurl=self.target_url)
  72.        
  73.         with open(output_file, 'w') as report:
  74.             report.write("<html><body>")
  75.             report.write("<h1>Web Vulnerability Scan Report</h1>")
  76.            
  77.             report.write("<table border='1'>")
  78.             report.write("<tr><th>URL</th><th>Risk</th><th>Alert</th><th>Description</th></tr>")
  79.            
  80.             for alert in alerts:
  81.                 report.write(f"""
  82.                <tr>
  83.                    <td>{alert['url']}</td>
  84.                    <td>{alert['risk']}</td>
  85.                    <td>{alert['name']}</td>
  86.                    <td>{alert['description']}</td>
  87.                </tr>
  88.                """)
  89.            
  90.             report.write("</table></body></html>")
  91.        
  92.         print(f"Report saved to {output_file}")
  93.    
  94.     def run_comprehensive_scan(self):
  95.         """
  96.        Execute a comprehensive web application vulnerability scan
  97.        """
  98.         try:
  99.             # Ensure ZAP is connected and configured
  100.             self.configure_scan_settings()
  101.            
  102.             # Perform spider scan to discover site structure
  103.             self.start_spider_scan()
  104.            
  105.             # Perform active vulnerability scanning
  106.             self.start_active_scan()
  107.            
  108.             # Generate vulnerability report
  109.             self.generate_report()
  110.        
  111.         except Exception as e:
  112.             print(f"An error occurred during scanning: {e}")
  113.  
  114. def main():
  115.     # Example usage
  116.     target_url = 'https://example.com'  # Replace with your target web application URL
  117.     scanner = WebVulnerabilityScanner(target_url)
  118.     scanner.run_comprehensive_scan()
  119.  
  120. if __name__ == '__main__':
  121.     main()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!