ZAP testing of .NET microservices

22 views Asked by At

I am trying to test two NET microservices with ZAP, I have written this .py script

    import requests
from zapv2 import ZAPv2 as ZAP
import time
import datetime
from os import getcwd

# Test Automation Part of the Script

# Hello Service
hello_url = 'http://localhost:5074/hello'
hello_response = requests.get(hello_url)

if hello_response.status_code == 200:
    print("Hello Service Response:")
    print(hello_response.text)
    print()
else:
    print("Hello Service returned non-200 status code:", hello_response.status_code)

# World Service
world_url = 'http://localhost:5039/world'
world_response = requests.get(world_url)

if world_response.status_code == 200:
    print("World Service Response:")
    print(world_response.text)
    print()
else:
    print("World Service returned non-200 status code:", world_response.status_code)

# ZAP Operations
# (No changes to the ZAP part of the script)


zap = ZAP(proxies={'http': 'http://localhost:8090', 'https': 'http://localhost:8090'})

if 'Light' not in zap.ascan.scan_policy_names:
    print("Adding scan policies")
    zap.ascan.add_scan_policy("Light", alertthreshold="Medium", attackstrength="Low")

# Active Scan for Hello Service
hello_active_scan_id = zap.ascan.scan(hello_url, scanpolicyname='Light')
print("Hello Service - Active Scan ID: {0}".format(hello_active_scan_id))

# Active Scan for World Service
world_active_scan_id = zap.ascan.scan(world_url, scanpolicyname='Light')
print("World Service - Active Scan ID: {0}".format(world_active_scan_id))

# Monitoring Active Scan Status
while int(zap.ascan.status(hello_active_scan_id)) < 100 or int(zap.ascan.status(world_active_scan_id)) < 100:
    print("Current Status of ZAP Active Scan (Hello Service): {0}%".format(zap.ascan.status(hello_active_scan_id)))
    print("Current Status of ZAP Active Scan (World Service): {0}%".format(zap.ascan.status(world_active_scan_id)))
    time.sleep(10)

# Exporting ZAP Report
now = datetime.datetime.now().strftime("%m/%d/%Y")
alert_severity = 't;t;t;t'  # High;Medium;Low;Info
alert_details = 't;t;t;t;t;t;f;f;f;f'
source_info = 'Vulnerability Report for Microservices;Your Name;API 
Team;{};{};v1;v1;API Scan Report'.format(now, now)

# Exporting ZAP Report for Hello Service
hello_path = getcwd() + "/zap-report-hello.json"
zap.exportreport.generate(hello_path, "json", sourcedetails=source_info,
                          alertseverity=alert_severity, 
alertdetails=alert_details, scanid=hello_active_scan_id)

# Exporting ZAP Report for World Service
world_path = getcwd() + "/zap-report-world.json"
zap.exportreport.generate(world_path, "json", sourcedetails=source_info,
                          alertseverity=alert_severity, 
alertdetails=alert_details, scanid=world_active_scan_id)

# Shutdown ZAP
zap.core.shutdown()

and i keep facing this error

  raise ProxyError(e, request=request)
requests.exceptions.ProxyError: HTTPConnectionPool(host='localhost', 
port=8090): Max retries exceeded with url: 
http://zap/JSON/ascan/view/scanPolicyNames/ (Caused by 
ProxyError('Cannot connect to proxy.', RemoteDisconnected('Remote end 
closed connection without response')))

Can some one please help me with this.What am I doing wrong here?There are two dot net services running with docker compose each has two docker files and are running with there endpoints. /hello and /world

0

There are 0 answers