From 76b800a83ba3bcb0803004254ada5d396d94f1f9 Mon Sep 17 00:00:00 2001 From: Simon Bennetts Date: Mon, 6 Jan 2025 15:44:13 +0000 Subject: [PATCH] Client: enable spider + help Signed-off-by: Simon Bennetts --- addOns/client/CHANGELOG.md | 1 + .../client/ExtensionClientIntegration.java | 33 ++++++---------- .../addon/client/spider/ClientSpider.java | 1 - .../client/ui/PopupMenuClientAttack.java | 9 ++--- .../resources/help/contents/ajax-scan.html | 2 + .../resources/help/contents/automation.html | 35 +++++++++++++++++ .../resources/help/contents/client.html | 37 +++++++++++++++++- .../contents/images/node-content-loaded.png | Bin 0 -> 676 bytes .../help/contents/images/node-fragment.png | Bin 0 -> 695 bytes .../help/contents/images/node-minus.png | Bin 0 -> 5885 bytes .../help/contents/images/node-redirect.png | Bin 0 -> 5982 bytes .../help/contents/images/node-standard.png | Bin 0 -> 519 bytes .../resources/help/contents/spider.html | 33 ++++++++++++++++ .../addon/client/resources/help/index.xml | 2 + .../addon/client/resources/help/map.jhm | 2 + .../addon/client/resources/help/toc.xml | 2 + .../resources/overlay-content-loaded.png | Bin 734 -> 756 bytes 17 files changed, 126 insertions(+), 31 deletions(-) create mode 100644 addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/automation.html create mode 100644 addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-content-loaded.png create mode 100644 addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-fragment.png create mode 100644 addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-minus.png create mode 100644 addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-redirect.png create mode 100644 addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-standard.png create mode 100644 addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/spider.html diff --git a/addOns/client/CHANGELOG.md b/addOns/client/CHANGELOG.md index 41d65fd1353..6162c10dd4e 100644 --- a/addOns/client/CHANGELOG.md +++ b/addOns/client/CHANGELOG.md @@ -12,6 +12,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ### Added - Added support for Browser Based Authentication when installed in conjunction with the Auth Helper add-on. +- Client spider, along with Automation Framework support. ## [0.9.0] - 2024-11-29 ### Changed diff --git a/addOns/client/src/main/java/org/zaproxy/addon/client/ExtensionClientIntegration.java b/addOns/client/src/main/java/org/zaproxy/addon/client/ExtensionClientIntegration.java index e9db3aeaf6f..ea5ce5ba3a4 100644 --- a/addOns/client/src/main/java/org/zaproxy/addon/client/ExtensionClientIntegration.java +++ b/addOns/client/src/main/java/org/zaproxy/addon/client/ExtensionClientIntegration.java @@ -196,16 +196,13 @@ public void hook(ExtensionHook extensionHook) { extensionHook.getHookView().addWorkPanel(getClientDetailsPanel()); extensionHook.getHookView().addStatusPanel(getClientHistoryPanel()); - if (Constant.isDevMode()) { - // Not for release .. yet ;) - extensionHook.getHookMenu().addToolsMenuItem(getMenuItemCustomScan()); - extensionHook - .getHookMenu() - .addPopupMenuItem( - new PopupMenuSpider( - Constant.messages.getString("client.attack.spider"), this)); - extensionHook.getHookView().addStatusPanel(getClientSpiderPanel()); - } + extensionHook.getHookMenu().addToolsMenuItem(getMenuItemCustomScan()); + extensionHook + .getHookMenu() + .addPopupMenuItem( + new PopupMenuSpider( + Constant.messages.getString("client.attack.spider"), this)); + extensionHook.getHookView().addStatusPanel(getClientSpiderPanel()); // Client Map menu items extensionHook @@ -815,10 +812,6 @@ public void resumeAllScans() { } private void addScanToUi(final ClientSpider scan) { - if (!Constant.isDevMode()) { - return; - } - if (!EventQueue.isDispatchThread()) { SwingUtilities.invokeLater(() -> addScanToUi(scan)); return; @@ -837,9 +830,7 @@ public void sessionAboutToChange(Session session) { spiderScanController.reset(); if (hasView()) { - if (Constant.isDevMode()) { - getClientSpiderPanel().reset(); - } + getClientSpiderPanel().reset(); if (spiderDialog != null) { spiderDialog.reset(); } @@ -848,14 +839,14 @@ public void sessionAboutToChange(Session session) { @Override public void sessionChanged(final Session session) { - if (hasView() && Constant.isDevMode()) { + if (hasView()) { ThreadUtils.invokeAndWaitHandled(getClientSpiderPanel()::reset); } } @Override public void sessionScopeChanged(Session session) { - if (hasView() && Constant.isDevMode()) { + if (hasView()) { getClientSpiderPanel().sessionScopeChanged(session); } } @@ -867,9 +858,7 @@ public void sessionModeChanged(Mode mode) { } if (hasView()) { - if (Constant.isDevMode()) { - getClientSpiderPanel().sessionModeChanged(mode); - } + getClientSpiderPanel().sessionModeChanged(mode); getMenuItemCustomScan().setEnabled(!Mode.safe.equals(mode)); } } diff --git a/addOns/client/src/main/java/org/zaproxy/addon/client/spider/ClientSpider.java b/addOns/client/src/main/java/org/zaproxy/addon/client/spider/ClientSpider.java index 7f946bd08f4..52463d55c87 100644 --- a/addOns/client/src/main/java/org/zaproxy/addon/client/spider/ClientSpider.java +++ b/addOns/client/src/main/java/org/zaproxy/addon/client/spider/ClientSpider.java @@ -89,7 +89,6 @@ public class ClientSpider implements EventConsumer, GenericScanner2 { * * TODO The following features will need to be implemented before the first release: * Support for modes - * Help pages * * The following features should be implemented in future releases: * Clicking on likely navigation elements diff --git a/addOns/client/src/main/java/org/zaproxy/addon/client/ui/PopupMenuClientAttack.java b/addOns/client/src/main/java/org/zaproxy/addon/client/ui/PopupMenuClientAttack.java index adc3cfd3f07..de3f128f707 100644 --- a/addOns/client/src/main/java/org/zaproxy/addon/client/ui/PopupMenuClientAttack.java +++ b/addOns/client/src/main/java/org/zaproxy/addon/client/ui/PopupMenuClientAttack.java @@ -43,12 +43,9 @@ public boolean isEnableForComponent(Component invoker) { JTree tree = (JTree) invoker; if (ClientMapPanel.CLIENT_TREE_NAME.equals(tree.getName())) { removeAll(); - if (Constant.isDevMode()) { - // Not for release .. yet ;) - add(new PopupClientSpider(clientMapPanel)); - List nodes = clientMapPanel.getSelectedNodes(); - this.setEnabled(nodes.size() == 1 && !nodes.get(0).isRoot()); - } + add(new PopupClientSpider(clientMapPanel)); + List nodes = clientMapPanel.getSelectedNodes(); + this.setEnabled(nodes.size() == 1 && !nodes.get(0).isRoot()); return true; } } diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/ajax-scan.html b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/ajax-scan.html index 572f17f7464..a79dd491052 100644 --- a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/ajax-scan.html +++ b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/ajax-scan.html @@ -18,6 +18,8 @@

Client Side Integration - AJAX Spider Enhancement

If it finds any 'missed' URLs that were part of the AJAX Spider scan scope then it makes direct requests to these URLs. You will be able to see these requests in the History, Sites Tree, and Output tabs. +

+This add-on also adds a Client Spider which is designed to explore modern web apps more effectively. diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/automation.html b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/automation.html new file mode 100644 index 00000000000..bfe444de8fb --- /dev/null +++ b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/automation.html @@ -0,0 +1,35 @@ + + + + + +Client Side Integration - Automation Framework Support + + + +

Client Side Integration - Automation Framework Support

+This add-on supports the Automation Framework. + +

Job: spiderClient

+The spiderClient job allows you to run the Client Spider, which is designed to explore modern web apps more effectively. +

+This job supports monitor tests. + +

+  - type: spiderClient                 # The client spider - a spider which explores modern web apps more effectively
+    parameters:
+      context:                         # String: Name of the context to spider, default: first context
+      user:                            # String: An optional user to use for authentication, must be defined in the env
+      url:                             # String: URL to start spidering from, default: first context URL
+      maxDuration:                     # Int: The max time in minutes the spider will be allowed to run for, default: 0 unlimited
+      maxCrawlDepth:                   # Int: The maximum tree depth to explore, default 5
+      maxChildren:                     # Int: The maximum number of children to add to each node in the tree
+      numberOfBrowsers:                # Int: The number of browsers the spider will use, more will be faster but will use up more memory, default 2 x number of cores
+      browserId:                       # String: Browser ID to use, default: firefox-headless
+      initialLoadTime:                 # Int: The time in seconds to wait after the initial URL is loaded, default: 5
+      pageLoadTime:                    # Int: The time in seconds to wait after a new URL is loaded, default: 1
+      shutdownTime:                    # Int: The time in seconds to wait after no activity before shutting down, default: 5
+ + + + \ No newline at end of file diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/client.html b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/client.html index 341ee84e19b..c1edb2dfaf8 100644 --- a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/client.html +++ b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/client.html @@ -8,6 +8,14 @@

Client Side Integration

+This add-on adds the following features to ZAP. + +

Client Spider

+ +This add-on adds a Client Spider which is designed to explore modern web apps more effectively. + +

Browser Extensions

+ This add-on adds a ZAP browser extension to both Firefox and Chrome when they are launched from ZAP.

The extensions stream significant browser based events back to ZAP, giving ZAP an insight into what is going on in the browser. @@ -16,7 +24,7 @@

Client Side Integration

Note that you may need to configure the extensions via their options pages to update the host and API key. @@ -38,7 +46,32 @@

Client Map

This means that the Client Map looks very different to the Sites tree for modern web apps, and may give you a better understanding of the client side structure of the sites.

-Any leaf nodes in the Map with a small red 'minus' sign represent URLs which have been found in the DOM but which have not been directly accessed by ZAP. +The following icons are used for leaf nodes so that you can easily tell their status: + + + + + + + + + + + + + + + + + + + + + + +
A URL which will be present in both the Site Tree and the Client Map
A URL which will only be present in Client Map as the URL contains a fragment
A URL which was found in the DOM but which has not been accessed yet
A URL which redirects to another URL
A URL which was loaded as content by the browser (e.g. JavaScript files) rather than as HTML
+ +

Selecting a node that has been visited by ZAP will display details about that node in the Client Details tab.

diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-content-loaded.png b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-content-loaded.png new file mode 100644 index 0000000000000000000000000000000000000000..0af831ff90007ea80ca12a61260c369d9480a20c GIT binary patch literal 676 zcmV;V0$crwP)3>QCdzdOcFjSlQb(b* ziu`g7OT{XxwK|>*9UCEBlp2JCS2r{eLclNp(==dNA#`;a2!#yrd9h?;?Byhmhqv4n ztHm3X;Ow*zVsW~OR84|tG=M|>`{)gcz8&32rq(`pDDcrvlek0{_`Q(9r`Kb!^I0^V zDpK#CqUF|9a}|UQc%2qZK@u1=J(iA+>U?Z2U!mr4<0#pVN4FdsxZO{P>DQ{2H<|Q>s>TWb7tGwD^uK^z`mj zzImT~{s^(_alCtxP_=F#t$=5g=f8C*XanfmXwaX}cJzw%nty=;<{Dp~-J;DDgzs$& z6cm>h;CUX3`9+*O7sH*wONgGmxUPV)%waCaR?6OitD|pnwU+!<@#Gw5xgpb>c0{oa3yU(@&0000< KMNUMnLSTYd96N0Q literal 0 HcmV?d00001 diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-fragment.png b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-fragment.png new file mode 100644 index 0000000000000000000000000000000000000000..fc4f92466b3cd432564e176b56a502deba4ee1b1 GIT binary patch literal 695 zcmV;o0!aOdP)O8mJscn%!009fH#ELV`%OUM;V$o|%m z%FZJ>S41LRK%uDP`PIXNggZ(NI_#+{8c31^Sq2nEhN`-tX);_c8N8p)=J4>0n(%&VVcf1MFbyXsE|Dejj=D{%)f(0` zlzJ8vi6mGGB$NtyjE}q!P4vtxqLHw$1D--yo3~tnYAFCIkdR5n;a%?&->Fy>8(X)F zGvVgMQR`aZGsq-;A`X~zI^&1Hr_oNa;87McLTj=E?`|}*J=yq-!q`s-b1}Y z>Rd8`V`uv@^6Wk~wX~wU=b-pA`J9O3G?4T0AC3jCG9dEyHQIOV5(hRt`3=o&ozCs> zV_RUZJn`~2CEp<#N@;^a zD37ATqiXP~D!iJ8Mv65J8k!p1SnF}atR*Wsb?=i)z8=dTTq;XhVxHkx7% dMdgnG0{{p=4583eou2>z002ovPDHLkV1m-)J23zN literal 0 HcmV?d00001 diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-minus.png b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-minus.png new file mode 100644 index 0000000000000000000000000000000000000000..1c56d0d977e6388d907a488b5ca76c3e93015150 GIT binary patch literal 5885 zcmeHKXH-+!77iT)ND)K@F$8$jkV;7=p-5;#G(Z$ZRBnec@)Klh#<-^fCcs4fOWmM)?2Ri-anIdlY7tk_ILLF&OZCxlS*Ie ztp#5IhrwW4zCP4I=wC;EsjEW2i^e_zFqq1*SjI|eAP|iZiG>_44@5{~L?8l`aXB!U ztovwiME01K=G0B=33Z=Grn|SrFkWa)yzU_nn=cIL1x((MZ^J(kZ*WAV!-UYZ8CZ%+69z=daX~p*;zu+NC2!?P)f_87>)zt3!65 zPwn-Y9sF)%Z)PnevqjrAE~+YS%F)EI(CFRcp12N|&RxsdhHjDnOd}n@#hv;E(;+&c z+NStab4LMovQp39lVO;&_-unoCES8}wWB%UsQ-~}o`!*&v{%zxnxoNT%t+0x^tZTI zSt{9UzFgmCzjgJTOQ+hThk4lBhp$L1a&Q3dif!$s>%w)<;)@ltI?`+(FiqG>jdVdT zpz2vF4190?`r^p11?6t;t}9Kfv)zVIA9E&CY_|FrsHB*@xaPhyav5yrgKj0wS^5bZ zuEODLGl{uk7JMr%-^}B6g5ncOa01)%YT?yubq;G&3A8SJidJL5_57p*2;FY;W}Oyd z#_QCjx*lC=(f8jyC<^{{(`>!aSEfnxyaKKV6yn>PbXa$Cm@5KG)^77!PCGQm(!Kp} z>*5^3(Y^Rhoa?!xQ7P`NYKz2`b%)K2N88L6UO;TxX?rP2FKs_V+;3wrUX-$+{4PUM zltSO|`wLp|df9qY>*gUWz;=nl++$3&HM@uTe= zon7f>Rwmn()z_OGT4gaHvvML-q-Gi9DcsV&VWZWMpC3_w>2}$Xhew~$N45-d3gg<- zKbDI*K9hd^_aomGhb-)&AKZDu&bT@-qZ)oxC>&Dp}TUvg;{n@l&Q8tRlZcP{taU=` zOy8i2{4VVQQy5VB20C3;66{QW;YdiIYsjF_TVe38ZeQP@08;onU47}26+@4pSb6Q24 zlO46izSs9YVS7VGld1WeapYf<$lpe;^zOvhl$OVx;q@#p(LMgh9Hgcm*ZXqZsTXUW zq^{rsaaJ~3J+Z4tJ1{}7%Y5cpch2o@WltPEka7r!CR6t=oHYcX8lv3R?dSaxb@x>E z-D5A|V+M_XOsvRlBDIPxMu*(_$lrE|-{aeo*VZ80e>Y_h`h}=DTk0Xb^-MS0^tdz0 zrj@GuBriPC4)MD8QY+&ZR#~s=5@+4P`IO>;#NOwa^lfdk+je~%Dsthg_dA5%kdR82 z8$CU(7=CX2mV4~7sbweLG>28SRb6OE#q_7QmqcC27l{7p_jKJk1Nhov#;JWUm_jnw z!-MYY;qkd*Lv=bgK8xa0N7qkYw)$-0zS&Wkk1`8Lt8@%D-m%dySX^ol5{Zc!Ttwjd z1cn-`bS7?dO}Dzxo;M!3>>eX}V_yHg$#5;Jm^}(ETV?wPQ#>!a zlWVwxxs$18$IY$l2kKd>YcgMF4V`Hb=BCYl7sIK)T0D?yR=@c4w*J{13lEDtI|TX{50W1~%ph&f z3dLQx7WQPNn}LmallBL-+VF_E|FG;WrYk<%eELO(E}~L{Fm&#HJg?`*9K{Up~lQw4>Tf4Qavx2=0|C>e(do}mjYRSM|Qq!PP zX2GhXf`n}zVSo5^4VksSVF!%z!ow= zdl_E@ZLu&I*;OV2SP`HU!34v(0t)hFbuALXWmAyB4m1o+bd`oxOCpxC7hR%`@| z$VR%lz{xTaM8F5707Ay+2_z&L1v$-2g6`$bXe449B8{LRSJLPR51|-D5bO!|7?h`s z8-+uBq$n4SwNns5W%zs6b#8j3<6T2 zm?0GMC`h>n2)X5#ZW^?n*nkwE0#Xnn#o!!B7%U0n$iO;~@K_R#V2i9vGFOs@(Oz?um`0z`rAX+I&ZnJ(6P zKoAZ><>OPnes1Ufhg@)EF!Z@OcEC7$f;_w6z>Hz`3;d^$8kRy!- z#GrdPq$8vil%LaDA*^O*%KCeF^mNiOF^5lzp+7~8mRF6>A(PSnCJK2P z@J*S4>}J}a@x^p|q@Ni=!k`9FR>O~(Im1c>_QAU~wRM zUkb28x$~e#HK{MnQ*BT|ReRBV?>Eu?(1H50FV&sl+>*YhHbUQBzsXe?H9@UkqEA*f zn)SiW=*7t$IoDiGeeBFvs;@YPNx6fxTCAhoZfo~msZcE?3?%GJKJKa4{^t>s@DcHa z>fzRk9KR^T$;6W}__~WXH`R`Dk^sij4V_zYYTkVA=Bd?DmydZ+#vchlpk&b=XYXvQ zR_jtlofDlgD^^#pIT&Z@Hx^t}W3%UOL|b3_o7*qipZ~pH5LxDQzH6%EVR#X(`gZ?# z&8P~)(nkCKZUaTCGV9L}k9n$lm!u#tJJi!TX$OS+FE~a$E8{tF((IJgWjmPsYbKfx zZe75a+Vns6UNu!!@fPiN#6W?iJYbb%p4!v58b-HOk8|{L*HP#|CTP?siUfrEc?yw0 zLGtjzU5UzDpV;N(Dk`%Aja*735%Ixi;9}Ux1SM1Ct~2=s4>a5)_f}TBdQ81BgYUrh z?!44@Fol~Oc{mvHLHV!DzH(dtwd7x24r+v>!qzP>FPT($6qUg?V4J>g36}lMRk>q3 zk7{(9$Dch+cb~r_HLmG6*7%(1bCed|pS(%4Zp-pB3PBYe4U@|ROBMJUxyo-(q@%}; n@HbswEoy(O+p%?y+mxYH>3UxHkgF*)zc63VrPSXShb8_CZjvC| literal 0 HcmV?d00001 diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-redirect.png b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-redirect.png new file mode 100644 index 0000000000000000000000000000000000000000..c567506ae7048884b7ddb1c76b06904d6cf4541e GIT binary patch literal 5982 zcmeHKdo)yQ8y|!kg&dOm7%J4B`^8K%3PY&LU^?ic_RMV4Fc)S9gQ7#}=te0NIVg#u zD4`OSL?w07#jR3GcXcG)`}WXvecxK&YOU}4ubH)H_I@tE_j!Kr^FHspQ#teJOhB3= z5eUQtZ!eZV{BNkf#_GVoHiMr)1VXzcjvJ)(2V+nXa#^TI455^<5fBPei9!(wRcBFP z_?AJ3@$cIlUyViCTA%F=uA<(!D;ty>O)KemL&?KW=9fIoTwT^VD=}usG=bIWG~K1< zL2grhWTlO#Rp!C{mZ@9|8gu01O zkJw04mXjHV8xwj`?ob*JOS2`YGDu{aoEYLJ-B%`@0)E&RS=npys;f#je!=avspb~f zoQYR78}2SOo~FFOm}$;*{j2}agI!Ito2TWKFCA0plHZw@5yGvFyFXZSbRQ)0?X_rm z7B*|sbh~Pc6>kcJZImb0Jx%*w>0RFV;l-`^2`kIZ_IX|VBdppqDw7bOodt%~=p!## zis_A<*)uo&X@@G+b1QgMNZiCLv~9k+k$lzu3Oh%F*ER&m9@bWcZVX+m_;uVpTcR!Z zWb`+0(_&!)qR%Tq{1r*N2V16*x9=pEfD3)ze86C+OE=D@WZ4FN)4&D~QnSv6f^KKN zxiNlahEv9EMR%fmU`i4p$lB4!RU9(4GJDRH+m0lDVg3@@@)bQgvnMXrYnYs($(axg z=3dTgw$MUrjqzDEU+n0vVdrLoY9UlM2jusfr>Tg=TMSc7n*1*0k0GpQ9!||gWmYA< zenCN{Y&jS-G4jq7udRJIf~Q@i4S4#^%d1-ua(wWnuFXoMr8xa|l7VewI@-hY^4151 zX|_$-Mk}TU%~#PuH=peUVU7oswNjsUpKIuHW|Cw1Ya^c-CI0u;z4co%L~aiXAWkS~ z7iZkxAuBkONp~wd^ytXkn4aNFeBZ3FMc1nDnwD-aGiMhyu@XyC{07p-5znQLZ$(XZ z49~BzF+$~wmhVZf$V`#D6RpMt+m1;mkoJW-=x9rb_C1zQjRB9f@=tTA_nxkozAQdh zV%vk=7JvO|Mp%^C9dbHS8IfLU){%9Pp1iTv|H+1hWK7ems)bQDudhT~B;7PN`k3D* z(NUT+`)=;Y_w8C~X?1Q*t&T_ReB*HUop<*VBRd-&{bM?u_wGrpfUQtu8sQ9Rm`|1O zvyOd|Nrt1}2G$0ZZz>cozP!K4*s60!_(bkqO!w9|^H>CN{l#ZP`R%_yy|2}Zw$2#{ z@2QG>5qDtd<_?4B?M?j@nchtu6RNkvw&N9(6*UIu6Fav$UEnpo&(8Fzd3QfOYwiA= zx?A@3&uGW9=CRrgt{u&OcvM-@B8yI9?t7c!SC?#g^sh75>jd02Qq>jH+TGO7_G;&s zwKH6IxKhl52M;>7&%7(OJF1Mn+bUjoQvZ;bUT2Gbij(h+2Y&#vc|M6(Ub`+*v>gVv zG$kD2$AH`cRANJrspY}dNg0`X!efPhQ#$IDH=I3lZtYsoHOZx+`;mE%ht{4Qgw0jM zw}sWfM+b(oEy@gSxYt)Y2BRHteL;Uy1%vaqYsr9v$+EZMqM|pts*clppO7WiI}?gt zpFH@MRk7b&75~!jKqcp(nen)pcH^+|7ErL0pk2I?*=yahbLQDgWwh5mzQqXdMT&(p zdY07gN@!#pNg5I~>T){nk+<@&=Ypv1yDSgPiz%LyV~v`7W6!l`euo`zv(>Aw5`Nu>@ejIO|K_WlTj6_8Y1oL{22g4K{~S4BbYc zPF#Jxa)tfd>5Qwu{KPPJ5P^2;JUH*XU&altGv!6V+(mNa~4or3i$^8j-s@ z$J^cgOVfs1b?(Z|Os~@%<2AmEstUL1N2lLOFQ5k-nnboc85g+iHCY&ii+yNA5_$PA zw$#3!lss$w0$o$#60619uFrKFmqhq0HyaJiMFPCz&s8@4Jqp!;OT(?bxT{ahb-AsC zzgt$Px0WGK2EM+Oj4OPQm0i-7%0uQ2Mfvt{VPqk}wt4O}5A3DW-N*;QXW2xtx zkNeLf`+^BhRc(XHub6uptq)2Xt3e2J*rll#*-7@FxBDTZw>OQRuz4|| z_S~|*pxGu)_Gb+~>edUxCrzE!y_=)?Afe)E+C)^19_jIs4=cr8t-qn3k6$d3Bvxr$ zSg|EU7G7b8IzD0X;%aiNK~1+tN}jSM-O_RP`K1ns0pUwFZQ1il4;CrbeHy;p4K)$lNB<>KryT*y&T{MV2kIt7#FrYxjgD@&d z1iZ^45R6%>2#_BRDN#H~D3UVK1IOyoD3O4P4kWX2>B$VQ_$lN)$~% zyC6{vxgeD8&+_~X0Y5R(%azIqIu;uf6N8B%Vq|h57Ehzmus8yiKmcG1KoKidf+|3& zuv0^fVz3|uUoMJJieyrh8WZHnqLfTD8rGw}#3zYhv%kVi6`xsv`M|2c2rM3h!%8IB z?>!Vsk7yX=b3p&mL&1d)BUpb(A&ZjpA&+QCsreDzRMAQVX=M!aCMf3Q@FLcfvqLu_izNIKsK0=s|3{lWT6?jy#q6`M_G z$@o#~@Vr?}w0eBHK*kpd=p(nzcs?nVL=^x6JdY2MaO6;cN5xYCnllBY;&4bRP{3J0q7j^_JQ5Y8j6ezabWfRF0>aZN zl7K=88zB{rDAa`0T{+%NGy#MACgF%dWhm^xM6*FY$~WMfhAWal0ZLF!C!R{A;HgwH ze94#gpkoJe^FLj>FM$-`UFqqR`m?X02X5D8}fV zdx;eA_^~6R(IpiCMUFm=K8i&nYYBxKSrv4UKbnF9jD`dwal%-mD*kd%Dum$n@wr~V z$VLC57C;(NKmkb*K&DWL013pC03OMi0)PY>iA=!@KtbqeIekS}$U>Ddpd4})!aTxU z!Sy-970O|BrW}6^CT2OLo(7mP0EY*@F-HB&81{3rw^-~P|l<}|X`bF1IG4NByzpCqh zMi=ti3l$`Vk3li;>(b!+Y(4l@ONTdi4h!)~{mri{&VVK3BD{hX2!!5m>PrK$BX=?^ z)Kz-3J#-&x=or}0R%8VN2!y7MH_Mgle17E?U#|?%^6ad(cP9>Q*m0`aC*--&5lk{< z<+;IXKf~)Xw3BYEL?$u3IIX?553Ic>rrIlC8if!HjN;O_YbRBi9R4^%X&YaBQFx`U zUSBa^G#I1GvoUBJK0WY`vGh!|$DNFa>p_C=!)+b~acVJ!wfX*E`D)jZ9q!9>~Kt30Nt)}K9NO<~xsiDQapH?Et{8qf@k z@x5I#4^iGVnKv2PIE0AIk4jtfaeFvoe6E>fES`O)Ai(BgmQT?&W_`r-Cs)=MaK@Gm zZQ6J)oLX_lv}SEFRwvo@@UFimHrc3>UU>D_xB*Ul3Yih<| z>EqZe)-FHGvl{tDMbNDort3Wj+sCJ}+_d`lyA?EacXw~X<+M_aXKr$L`K!M_t*DZ- z0eA&q99C_bV|8cv-HW)o3l}d^#;Djfy?2=_-gkctz5in8^sAPnVw>G*53@s%V>FkS zZGZMj8$EW_D()m!ehZ=2EFRL7G?Z$Sv?S9em8aSJoTehAJ&ClsTQmC-iZiP<7JWkS XTwa(qFhgwM>OpvW%x9ImElc_r`4vK0 literal 0 HcmV?d00001 diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-standard.png b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/images/node-standard.png new file mode 100644 index 0000000000000000000000000000000000000000..6b2545a5a31915b051147d705e8ae6563b08b8cd GIT binary patch literal 519 zcmV+i0{H!jP)YxP`S}Cpl{z#tpCQTb9DPFkb z=G}A7JNI3YJ1Afro0J*M4g#weC^b1S=)kX+&USM7Zhr*ZabVjDjzhgMxb#-RN#S*y zO2NNANpk^S>iyvejZP2sRu8rB4l1=aKEGP{s5a4Tb#Sq}mM7c>@v@-;LI`LY*)lXp zslzli=(+|zuh!}~zrMwKHg+u9)qP5E21n4@oF}4O5kCe4V0C4g?oh}qrf~Dzy`R2; zawau#i7aS#go@bq7^@s3AfToKWWgUJN(6k1Qbw2q={aC>vkYz0cq>s3q~`!LMY#V*Km{ClBk*dYM7*||2xyJ+BU~4(DufFV<1dT&Tk*c` zo;)mZn5z{p52<*7aE3|W!7LHCM_A@Cm!H-uULB<|>MaoK8FAR002ov JPDHLkV1n$i+Fbwu literal 0 HcmV?d00001 diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/spider.html b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/spider.html new file mode 100644 index 00000000000..c78a1888d55 --- /dev/null +++ b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/contents/spider.html @@ -0,0 +1,33 @@ + + + + +Client Side Integration - Client Spider + + + +

Client Side Integration - Client Spider

+ +This add-on adds a Client Spider which is designed to explore modern web apps more effectively. +

+The Client Spider works in a similar way to the AJAX Spider but it has access to the DOM via the ZAP Browser Extension +which means that it can find content which the AJAX Spider cannot find. +

+While it is still at an early stage we believe it is a more effective approach than the AJAX Spider. +
+We will be focussing on improving the Client Spider and the current plan is for it to supersede the AJAX Spider +as the recommended way of crawling modern web apps. +
+We would appreciate feedback via the ZAP User Group +to let us know how effectively it works for you, especially in comparison with the AJAX Spider. + +

+The spider can be invoked via: +

    +
  • Context specific "Attack" menu +
  • "Tools / Client Spider" menu item +
  • Automation Framework spiderClient job +
+ + + diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/index.xml b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/index.xml index a37c9d2799a..ec234b2f9b3 100644 --- a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/index.xml +++ b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/index.xml @@ -6,6 +6,8 @@ + + diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/map.jhm b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/map.jhm index a806e76ceb4..1a97ca845bb 100644 --- a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/map.jhm +++ b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/map.jhm @@ -6,6 +6,8 @@ + + diff --git a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/toc.xml b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/toc.xml index b29ff103363..ba3d7b4eb10 100644 --- a/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/toc.xml +++ b/addOns/client/src/main/javahelp/org/zaproxy/addon/client/resources/help/toc.xml @@ -7,6 +7,8 @@ + + diff --git a/addOns/client/src/main/resources/org/zaproxy/addon/client/resources/overlay-content-loaded.png b/addOns/client/src/main/resources/org/zaproxy/addon/client/resources/overlay-content-loaded.png index 30f9e8298b1949d01def34612bb4e9cef1721c99..2bdec1aa387398ee253464f0421ca2c171d2a973 100644 GIT binary patch delta 622 zcmV-!0+IdR1@r}wK@L;3B2@=Fh&W`ZPIghzkxwvxST8)@$9eZ0-n$PF>Sd-`T`@q@ zZ8MdKi<#`I7j39Ak!Q6K@dD zY}y9rec})+$|~_W@q|eiB!1+&;_(~jg3AKW44LWFJaLFvEVQxG#;j;+#M8uKRnsY7 z$at)Oa^B*sm8-0IPyWJSPG4E(I;~M8u!to{5TT%o63VajJ_!g4BY~KYu?j29?-y~DeE+voOgPjh}h>3DM1f-?4cld%CQe*pwZL_t(I%VS^|@_-SW;FhE3 z{@*@zkU`1Vj)9#=fZ_VVO$>_W-V6a&Y8dL7uo-aW@Gb_+;6#S&$96OD3JNj&{P~lC znHj5H*bVsk^Ctrn6C;#{@L5=xh&Mpr!GmG_)D8w+J9mc9@82-|`0<0`=hu(KhrziQ zpa1{=fB&E1-#-Qh2>qYo|Ns9Cmhytcg~5XxR~Y6tS1>R!F)-Y}c9CIGM-{_^>z9c4 zf{>U5!_S{T85kKE8FsB)$dFjw!LVobBH|5TVEE7Q>(?&^CMHHG&A{;M*DvA?c>U}N z!|&g}8D2ks%HSE5$k1Jw#^4^2Fo=`05G9(K92giF1Sv590F^0Xnt1&z;Q#;t07*qo IM6N<$g7$+jg8%>k delta 600 zcmV-e0;m1-1>OaaK@MBBqLmJI5OK&*o$R8bkxwvx7%x2D$9eZ0-n$R*H!4guyW)VV zSw=dU5VE;dA@~X(deDyK5>MVB!&2#c-){15$?=2#!SC6cg~S6bU&Z2+^M zq}SV8^au!V0~gnAP2K}8cYvWMT{0v`3efU27Ye}p8GTa@7`z4g*4(+Z&T;wxWN22Y z8{ps&7%Nity2rbFJLmRqPiuZZd+>6q{#J@#ld%CQe*o@DL_t(I%hi%WPQm~XMIY5F zX{SweB^1#^cn(kKRlI-)5$lQ?pxAW&xF9hB7A0Y$v;4__dHEUm_cuBWUS8iKLRe<3 zH!Y9T2f9wUi-_R)soLvY9s=gG8B!1-%AzDqF97H|aMzK+5#YUEV41OO8X|;T^t~95 zGghn3e=uNPRY*Zu6u&0&pzn7^gMh_njk_ZSmK)1uLt%zotT*j2;J%t71#<07tk~P+ zgbive&uN-3+#SmeDQMd*S7|y7m`x@`1f}hY#q}5oA_6H++28{OSeCQ>-csIGBuOBR mNRq$$&bQ~36X50?zz;_Ji7X8?tPubJ002ov22Mn-LSTZWAr&(K