Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

#8721 having some trouble #5769

Draft
wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

#8721 having some trouble #5769

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7e0955c
current work
jessemchung Sep 18, 2024
78abab5
Merge branch 'zap8271' of https://github.com/ZaproxyFirstFix/zap-exte…
jessemchung Sep 24, 2024
b5b53e2
Merge branch 'main' of https://github.com/zaproxy/zap-extensions into…
jessemchung Sep 24, 2024
e86d8e7
more stuff pushed up, pause seems to be working maybe. Hard to say b…
jessemchung Sep 24, 2024
31a65ee
#8271 stuck
jessemchung Sep 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 75 additions & 2 deletions addOns/quickstart/src/main/java/org/zaproxy/zap/extension/quickstart/AttackPanel.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@
package org.zaproxy.zap.extension.quickstart;

import java.awt.GridBagLayout;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

import java.net.URL;
import java.util.List;
import javax.swing.Box;
Expand Down Expand Up @@ -48,6 +51,7 @@ public class AttackPanel extends QuickStartSubPanel {
private static final long serialVersionUID = 1L;

private static final String DEFAULT_VALUE_URL_FIELD = "http://";
private static final Logger LOGGER = LogManager.getLogger(AttackPanel.class);

private ImageIcon icon;
private JButton attackButton;
Expand Down Expand Up @@ -84,6 +88,7 @@ public String getTitleKey() {
@Override
public JPanel getDescriptionPanel() {
JPanel panel = new QuickStartBackgroundPanel();
// here we are. God damn it
panel.add(
QuickStartHelper.getWrappedLabel("quickstart.attack.panel.message1"),
LayoutHelper.getGBC(0, 0, 2, 1.0D, DisplayUtils.getScaledInsets(5, 5, 5, 5)));
Expand Down Expand Up @@ -152,10 +157,12 @@ public JPanel getContentPanel() {

traditionalSpiderY = ++formPanelY;
plugableSpiderY = ++formPanelY;


// this sets the horizontal panel for the start and stop buttons I guess?
JPanel buttonPanel = QuickStartHelper.getHorizontalPanel();
buttonPanel.add(this.getAttackButton());
buttonPanel.add(this.getStopButton());
buttonPanel.add(this.getPauseButton());
// buttonPanel.add(this.getStopButton());
buttonPanel.add(Box.createHorizontalGlue());
contentPanel.add(buttonPanel, LayoutHelper.getGBC(2, ++formPanelY, 1, 1.0D));

Expand All @@ -172,6 +179,7 @@ public JPanel getContentPanel() {

return contentPanel;
}
//! I think something needs to be here.

private JLabel getProgressLabel() {
if (progressLabel == null) {
Expand Down Expand Up @@ -331,8 +339,10 @@ private JButton getAttackButton() {
attackButton.setToolTipText(
Constant.messages.getString("quickstart.button.tooltip.attack"));

//
attackButton.addActionListener(
e -> {
//
if ((traditionalSpider == null || !traditionalSpider.isSelected())
&& (plugableSpider == null || !plugableSpider.isSelected())) {
getExtensionQuickStart()
Expand All @@ -342,12 +352,54 @@ private JButton getAttackButton() {
"quickstart.url.warning.nospider"));
} else {
attackUrl();
// change the button to pause for now.

//we also need some kind of check if it is currently paused
attackButton.setText(Constant.messages.getString("quickstart.button.label.pause"));
// we need something to check what the state of the scan is at this moment.
}
});
}
return attackButton;
}

// Likely not needed given new requirements given :)
private JButton getPauseButton() {
if (stopButton == null) {
stopButton = new JButton();
stopButton.setText(Constant.messages.getString("quickstart.button.label.pause"));
stopButton.setIcon(
DisplayUtils.getScaledIcon(
new ImageIcon(
SearchPanel.class.getResource(
"/resource/icon/16/141.png")))); // 'pause'
// icon
stopButton.setToolTipText(
Constant.messages.getString("quickstart.button.tooltip.stop"));
stopButton.setEnabled(false);

stopButton.addActionListener(e -> {

// need to check if paused. We need to check if the button was already clicked maybe?
//just check if it paused and then handle accordingly
boolean checkPause = checkPauseStatus();
System.out.println(checkPause);
System.out.println("checkPause");
LOGGER.debug("what is this");
LOGGER.debug(checkPause);
LOGGER.info("does this help?");


if (checkPause == true) {
resumeAttack();
} else {
togglePauseAttack();
}
});
}
return stopButton;
}

private JButton getStopButton() {
if (stopButton == null) {
stopButton = new JButton();
Expand All @@ -367,6 +419,7 @@ private JButton getStopButton() {
return stopButton;
}

//! this part attacks
boolean attackUrl() {
Object item = this.getUrlField().getSelectedItem();
if (item == null || DEFAULT_VALUE_URL_FIELD.equals(item.toString())) {
Expand Down Expand Up @@ -421,6 +474,26 @@ private void stopAttack() {
stopButton.setEnabled(false);
}

private void togglePauseAttack() {
LOGGER.info("toggle");
getExtensionQuickStart().togglePauseAttack();

// stopButton.setEnabled(false);
}

private void resumeAttack() {
getExtensionQuickStart().resumeAttack();

// stopButton.setEnabled(false);
}


private boolean checkPauseStatus() {
return getExtensionQuickStart().checkPause();

// stopButton.setEnabled(false);
}

private void setSpiderButtonsEnabled(boolean enabled) {
if (traditionalSpider != null) {
traditionalSpider.setEnabled(enabled);
Expand Down
80 changes: 74 additions & 6 deletions addOns/quickstart/src/main/java/org/zaproxy/zap/extension/quickstart/AttackThread.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,15 +32,15 @@
import org.zaproxy.zap.utils.Stats;

public class AttackThread extends Thread {

public enum Progress {
notstarted,
started,
spider,
ajaxspider,
ascan,
failed,
complete,
failed,
notstarted,
paused,
spider,
started,
stopped
}

Expand All @@ -49,8 +49,14 @@ public enum Progress {
private TraditionalSpider traditionalSpider;
private PlugableSpider plugableSpider;
private boolean stopAttack = false;
private boolean useStdSpider;
private boolean pauseAttack = false;
private boolean resumeAttack = false;
Comment on lines +52 to +53
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you have two variables for this? Either it's paused or not. Trying to keep track of 4 possible values is just a headache

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was trying to find a good trigger for unpausing and I wasn't sure how to best have it trigger. Right now there is a check to see if it is stopped which triggers the stopscan feature and I needed things for pause and resume scan. The issue though was if I just check if pauseAttack is false, I risk causing trouble in the code where it will try to resume scan.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn’t paused false be the same as resumed true?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, starting out, both are false. This means it is just starting. But once the pause button is pressed, pause is true and resume is false and ideally pausing happens. Then, when resume happens, pause is false but resume is true which ideally should cause the app to resume instead of using start.


private boolean currentlyAttacking = false;


private boolean useStdSpider;
//! s
private static final Logger LOGGER = LogManager.getLogger(AttackThread.class);

private static final HttpRequestConfig REQ_CONFIG =
Expand All @@ -74,9 +80,13 @@ public void setPlugableSpider(PlugableSpider plugableSpider) {
this.plugableSpider = plugableSpider;
}

// running causes everything to be started. As a result stopAttack and pauseAttack are to be set to false
@Override
public void run() {
stopAttack = false;
pauseAttack = false;
currentlyAttacking = true;

boolean completed = false;
try {
Stats.incCounter("stats.quickstart.attack");
Expand All @@ -89,11 +99,22 @@ public void run() {
// the problem
return;
}

// what the heck am I supposed to do here?
if (stopAttack) {
LOGGER.debug("Attack stopped manually");
extension.notifyProgress(Progress.stopped);
return;
}

if (pauseAttack) {
LOGGER.debug("Attack paused manually");
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use error and you will even see them in the output tab :)

// extension.notifyProgress(Progress.paused);
return;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These pause checks outside the "wait loops" should wait instead of return (which would behave like stopping).

}



Target target = new Target(startNode);
target.setRecurse(true);
if (plugableSpider != null) {
Expand Down Expand Up @@ -121,7 +142,15 @@ public void run() {
if (this.stopAttack) {
spiderScan.stopScan();
break;
} else if (this.pauseAttack) {
spiderScan.pauseScan();
break;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't break here nor in the resume.

} else if (this.resumeAttack) {
LOGGER.debug("running resume scan");
spiderScan.resumeScan();
break;
}

extension.notifyProgress(Progress.spider, spiderScan.getProgress());
}
} catch (InterruptedException e) {
Expand All @@ -133,6 +162,13 @@ public void run() {
return;
}

if (pauseAttack) {
LOGGER.debug("Attack paused manually jesse2");
// extension.notifyProgress(Progress.paused);
return;
}


// Pause after the spider seems to help
sleep(2000);
}
Expand All @@ -143,6 +179,12 @@ public void run() {
return;
}

if (pauseAttack) {
LOGGER.debug("Attack paused manually jesse3");
// extension.notifyProgress(Progress.paused);
return;
}

// optionally invoke ajax spider here
if (plugableSpider != null && plugableSpider.isSelected()) {
plugableSpider.startScan(this.url.toURI());
Expand Down Expand Up @@ -195,6 +237,10 @@ public void run() {
sleep(500);
if (this.stopAttack) {
extAscan.stopScan(scanId);
} else if (this.pauseAttack) {
extAscan.pauseScan(scanId);
} else if (this.resumeAttack) {
extAscan.resumeScan(scanId);
}
extension.notifyProgress(Progress.ascan, ascan.getProgress());
}
Expand All @@ -215,6 +261,9 @@ public void run() {
} else if (stopAttack) {
LOGGER.debug("Attack stopped manually");
extension.notifyProgress(Progress.stopped);
} else if (pauseAttack) {
LOGGER.debug("Attack paused manually Jesse5");
// extension.notifyProgress(Progress.paused);
} else {
LOGGER.debug("Attack completed");
extension.notifyProgress(Progress.complete);
Expand All @@ -225,4 +274,23 @@ public void run() {
public void stopAttack() {
this.stopAttack = true;
}

public void togglePauseAttack() {
LOGGER.debug("paused inside the toggle");

this.pauseAttack = true;
this.resumeAttack = false;
// this.currentlyAttacking = true;
}

public boolean returnPauseState() {
return this.pauseAttack;
// this.currentlyAttacking = true;
}

public void resumeAttack() {
LOGGER.debug("we are changing the variables inside");
this.pauseAttack = false;
// this.resumeAttack = true;
}
}
21 changes: 21 additions & 0 deletions ...ns/quickstart/src/main/java/org/zaproxy/zap/extension/quickstart/ExtensionQuickStart.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -425,6 +425,7 @@ public void notifyProgress(AttackThread.Progress progress, String msg) {
break;
case failed:
case complete:
case paused:
case stopped:
this.runningFromCmdLine = false;
break;
Expand Down Expand Up @@ -461,6 +462,26 @@ public void stopAttack() {
}
}

public void togglePauseAttack() {
if (attackThread != null) {
attackThread.togglePauseAttack();
}
}

public void resumeAttack() {
LOGGER.info("What are we doing here. Is attackThread null?");
// it is not null
LOGGER.info(attackThread);
if (attackThread != null) {
LOGGER.info("inside the check");
attackThread.resumeAttack();
}
}

public boolean checkPause() {
return attackThread.returnPauseState();
}

public void showOnStart(boolean showOnStart) {
if (!showOnStart) {
// Remove the tab right away
Expand Down
5 changes: 5 additions & 0 deletions addOns/quickstart/src/main/java/org/zaproxy/zap/extension/quickstart/TraditionalSpider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,11 @@ public interface Scan {

void stopScan();

void pauseScan();

void resumeScan();


int getProgress();
}
}
11 changes: 11 additions & 0 deletions .../src/main/java/org/zaproxy/zap/extension/quickstart/spider/ExtensionQuickStartSpider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,17 @@ public boolean isStopped() {
@Override
public void stopScan() {
scan.stopScan();
// investigate this
}

@Override
public void pauseScan() {
scan.pauseScan();
}

@Override
public void resumeScan() {
scan.resumeScan();
}

@Override
Expand Down
5 changes: 5 additions & 0 deletions ...art/src/main/resources/org/zaproxy/zap/extension/quickstart/resources/Messages.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,11 @@ quickstart.button.label.attack = Attack
quickstart.button.label.back = <
quickstart.button.label.launch = Launch Browser
quickstart.button.label.stop = Stop
# Fix here
quickstart.button.label.pause = Pause1
quickstart.button.label.unpause = Unpause1


quickstart.button.news = Learn More
quickstart.button.tooltip.attack = Perform a quick penetration test on the URL
quickstart.button.tooltip.back = Back to the main screen
Expand Down
1 change: 1 addition & 0 deletions addOns/spider/src/main/java/org/zaproxy/addon/spider/SpiderAPI.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,6 +295,7 @@ public ApiResponse handleApiAction(String name, JSONObject params) throws ApiExc

return new ApiResponseElement(name, Integer.toString(scanId));

// something here.
case ACTION_PAUSE_SCAN:
scan = getSpiderScan(params);
extension.pauseScan(scan.getScanId());
Expand Down
Loading