ZAP Spider扫描显示0％状态并在Jenkins中终止

问题描述

我是ZAP Owasp的新手。我创建了一个ZAP Jenkins工作。我正在获得带有表单登录身份验证的消息

7983 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread  - Starting spidering scan on Context: SecurityTest at Mon Oct 05 10:06:27 EDT 2020
7989 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Spider initializing...

[ZAP Jenkins Plugin] SPIDER SCAN STATUS [ 0% ]
[ZAP Jenkins Plugin] ALERTS COUNT [ 0 ]

8023 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Starting spider...
8023 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Scan will be performed from the point of view of User: fred
8044 [ZAP-SpiderThreadPool-0-thread-1] INFO org.zaproxy.zap.users.User  - Authenticating user: USer
8274 [ZAP-SpiderThreadPool-0-thread-2] INFO org.zaproxy.zap.spider.Spider  - Spidering process is complete. Shutting down...
8278 [ZAP-SpiderShutdownThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread  - Spider scanning complete: true

Spider扫描状态仅显示0％，并显示Spider扫描完成：true。它未显示100％完成，并且报告未显示预期结果。如何解决此问题？

    USER user IS Now ENABLED

[ZAP Jenkins Plugin] ATTACK MODE(S) INITIATED

[ZAP Jenkins Plugin] SPIDER SCAN ENABLED [ TRUE ]

    SPIDER SCAN SETTINGS
        AUTHENTICATED SPIDER SCAN [ TRUE ]
        RECURSE: [ TRUE ]
        SUB TREE ONLY: [ FALSE ]
        MAX CHILDREN: [ 0 ]
        CONTEXT ID: [ 1 ]
        USER ID: [ 0 ]
        USER NAME: [ user ]

[ZAP Jenkins Plugin] SPIDER SCAN THE SITE [ https://localhost:8080/webui ] AS USER [ User ]

7983 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread  - Starting spidering scan on Context: SecurityTest at Mon Oct 05 10:06:27 EDT 2020
7989 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Spider initializing...

[ZAP Jenkins Plugin] SPIDER SCAN STATUS [ 0% ]
[ZAP Jenkins Plugin] ALERTS COUNT [ 0 ]

8023 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Starting spider...
8023 [ZAP-SpiderInitThread-0] INFO org.zaproxy.zap.spider.Spider  - Scan will be performed from the point of view of User: fred
8044 [ZAP-SpiderThreadPool-0-thread-1] INFO org.zaproxy.zap.users.User  - Authenticating user: user
8274 [ZAP-SpiderThreadPool-0-thread-2] INFO org.zaproxy.zap.spider.Spider  - Spidering process is complete. Shutting down...
8278 [ZAP-SpiderShutdownThread-0] INFO org.zaproxy.zap.extension.spider.SpiderThread  - Spider scanning complete: true

[ZAP Jenkins Plugin] AJAX SPIDER ENABLED [ FALSE ]
    SKIP AXAJ SPIDER FOR THE SITE [ https://localhost:8080/webui ]

[ZAP Jenkins Plugin] ACTIVE SCAN ENABLED [ FALSE ]
    SKIP ACTIVE SCAN FOR THE SITE [ https://localhost:8080/webui ]

[ZAP Jenkins Plugin] CLEAR WORKSPACE OF PREVIoUS REPORT(S) [ FALSE ]
    SKIP CLEARING WORKSPACE

[ZAP Jenkins Plugin] GENERATE REPORT(S) [ TRUE ]
    [ XML ] SAVED TO [ C:\Program Files (x86)\Jenkins\workspace\JENKINS_ZAP_VULNERABILITY_REPORT_34.xml ]
    [ HTML ] SAVED TO [ C:\Program Files (x86)\Jenkins\workspace\JENKINS_ZAP_VULNERABILITY_REPORT_34.html ]

[ZAP Jenkins Plugin] CREATE JIRA ISSUES [ FALSE ]
    SKIP CREATING JIRA ISSUES

[ZAP Jenkins Plugin] SUMMARY...
    ALERTS COUNT [ 0 ]
    MESSAGES COUNT [ 5 ]

[ZAP Jenkins Plugin] SHUTDOWN [ START ]

解决方法

除非没有其他选择，否则请不要尝试在Jenkins上调试ZAP的身份验证问题。使用ZAP桌面执行此操作-这样您就可以查看发生了什么。身份验证很困难-请参阅https://www.alldaydevops.com/zap-in-ten上的ADDO Workshop视频，我会详细介绍它们。

jenkins owasp zap