No Existing Zap Policies about bdd-security HOT 12 CLOSED

I've checked the ZAP gui and these are included by default. The only difference between these and the normal policies is that they're "beta" quality. But they do exist in the zap installation, so I think it'll be useful to include them.

from bdd-security.

Yes indeed they are very useful but the question becomes how do you enable or add a beta policy to zap embedded in jenkins. I know that you can do that in zap GUI but I am not certain in zap embedded in bed-security. Also the beta policies are not enable by default.

from bdd-security.

The policy should already be there in the embedded version. Since we'll bundle zap with bdd-security we can ensure that the required policies are always there.

from bdd-security.

But I ran bdd-sec several times and I am getting no-existing id which is the id of that policy recently added.

from bdd-security.

You sure you're using the embedded version of ZAP? config.xml should have the whole <proxy> section commented out or removed.
Another test you can do is run zap from the command line within bdd-security/zap and then connect to the API through a browser and view the policies:
http://zap/XML/ascan/view/scanners/?zapapiformat=HTML&scanPolicyName=&policyId=

from bdd-security.

Ok, I will test again.

from bdd-security.

By the way I am using zapPath>zap/zap.sh</zapPath in config.xml. Do I have to use the api?

from bdd-security.

The zapPath isn't used unless the proxy is commented out. You can use the GUI if you like, but I thought you were using this on a headless jenkins so no gui possible :)
Much simpler through the GUI!

from bdd-security.

@continuumsecurity, In my case the proxy was commented originally when I updated the code. :-)
Is this correct http://zap?

from bdd-security.

This is what I am getting from the api. I really believe that those new policies do not exit on the api.

Exception code="does_not_exist" detail="policyId" type="exception">Does Not Exist (does_not_exist) : policyId</Exception

from bdd-security.

Yes you are right! I tracked this down to ZAP loading the plugins from the zap home directory on my dev machine.

I've now added the beta active scan rules to the bdd-security/zap/plugins directory so that they will load by default on any installation.

from bdd-security.

Thanks I am glad that you saw what I was talking about. Also is there a way to disable the passive scanning under navigate-app_story because it flags some stuffs such as (X-frame options) which can be considered not a high finding.

from bdd-security.