Package: owasp-zap-historic
owaspzap-historicOWASP-ZAP-Historic (OZH) is a free, custom html report which provides historical ZAP execution results by storing execution results info in MySQL database and generating html reports from the database using Flask. It borrows heavily from the work done by adiralashiva8 forhttps://github.com/adiralashiva8/robotframework-historicMYSQL + Flask + OWASP Zed Attack ProxyUPDATE Release 0.2.0This release incorporates False Positives from the newer ZAP reports into the application. If you are an existing user
user of owaspzap-historic, you will need to make the following changes to your MySQL database:The following script will need to be ran on your TB_PROJECT table:ALTER TABLE owaspzaphistoric.TB_PROJECT ADD COLUMN Recent_False INT
NULL DEFAULT 0 AFTER Recent_Informational;The following script will need to be ran on any project's TB_EXECUTION table:ALTER TABLE [project_name].TB_EXECUTION ADD COLUMN False_Alerts INT NULL DEFAULT 0
AFTER Informational_Alerts;OZH OverviewFeaturesStore ZAP results historicallyVisualize ZAP results over time, by app version, by environment, etc.Search historical ZAP records by name / environment / scan type / execution id / etcExport results (Excel, CSV, Print, Copy)Why OZH?It is open sourceMade by QAHow OZH Works:ZAP job runs inJenkinsand produces report.html artifact and published HTML (stored in MySQL as URL_Link for access between OZH and published ZAP report)Parserstores results for one or more applications in local / remote hostedMySQLdatabase and creates a delta report forJenkinsto email out to recipient list.Generate report tables / reports usingFlaskRequirementsPython 3.6MySQL DBInstallationStep 1:Download and Install MySQL Server -guideStep 2:Install owasp-zap-historicCase 1: Using pip installpip install owasp-zap-historicCase 2: Using setup.py (root)python setup.py installCase 3: Using git (latest changes)pip install git+https://github.com/Accruent/owasp-zap-historic.gitStep 3:Createowaspzaphistoricdefault user with permissions -guideStep 4:CreateTB_PROJECTtableCREATE DATABASEowaspzaphistoric/*!40100 DEFAULT CHARACTER SET latin1 */;USE owaspzaphistoric;CREATE TABLETB_PROJECT(Project_Idint(11) NOT NULL AUTO_INCREMENT,Project_Nametext,Project_Desctext,Project_Imagetext,Environmenttext,Scan_Typetext,Created_Datedatetime DEFAULT NULL,Last_Updateddatetime DEFAULT NULL,Total_Executionsint(11) DEFAULT NULL,Recent_Highint(11) DEFAULT NULL,Recent_Mediumint(11) DEFAULT NULL,Recent_Lowint(11) DEFAULT NULL,Recent_Informationalint(11) DEFAULT NULL,Recent_Falseint(11) DEFAULT NULL,Versionvarchar(50) DEFAULT 'Not Captured',
PRIMARY KEY (Project_Id)
) ENGINE=InnoDB AUTO_INCREMENT=14 DEFAULT CHARSET=latin1;Step 5:CreateTB_USERStableCREATE DATABASEaccounts/*!40100 DEFAULT CHARACTER SET latin1 */;USE accounts;CREATE TABLETB_USERS(idint(6) unsigned NOT NULL AUTO_INCREMENT,namevarchar(255) NOT NULL,emailvarchar(255) NOT NULL,passwordvarchar(255) NOT NULL,
PRIMARY KEY (id)
) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=latin1;Step 5:Install robotframework-historic-parserpip install owasp-zap-historic-parserNote:All actions above are one time activitiesHelp / Know MoreTo know more on available commands refer to cmd helpowaspzaphistoric --help
owaspzaphistoricparser --helpHow to use OZHStep 1:Create user in OZHYou may have to bypass the security for the first time you create a user. Any user created has the authority to create another user beyond that.Remove / comment out lines 57 & 97 ({% if session['name'] %} and {% endif %}(from CMD) python setup.py install(from CMD) owaspzaphistoric(localhost:5000/register) enter a valid username and passwordLines 57 & 97 can be uncommented / replaced nowStep 2:Create project in OZHLogin to OZHClick theNew ProjectbuttonEnter a valid name for the project (it must meetMySQLdb naming standardsStep 3:Push data to OZH using owasp_zap_historic.py and owasp_zap_historic.batThese were built with processing from Jenkins in mind. At Accruent, the OWASP ZAP job can be ran as a standalone job or as a child job. In Jenkins, the parameters that OZH needs are defaulted for the standalone job (environment, version)The parameters that owaspzaphistoricparser expects from the CMD / bat file are:s --> mysql hosted machine ip address (default: localhost)t --> mysql port (default: 3306)u --> mysql user name (default: superuser)p --> mysql password (default: passw0rd)n --> project name in owasp zap historice --> environment name (default: Not Provided)i --> type of scan (active, passive, etc) (default: Not Provided)l --> URL for published ZAP report (default: Not Provided)v --> version of application tested by ZAP (default: Not Provided)f --> filepath & report.html produced by ZAPIn order to not store the production username/password in the repo, localhost entries are referenced in the repo. These can be hidden in the .bat file.Example call from Jenkins:email_body = bat returnStdout: true, script: """@cmd /c c://Jenkins/Scripts/owasp_zap_historic.bat "${html_file}" ${tag} ${targetURL.toUpperCase()} ${scan_type.toUpperCase()} "${url_link}" "${version}" """This returns the delta email body back to the email_body variable in Jenkins, which then emails the report to a recipient list.Here is the basic process for owasp_zap_historic.py:The ZAP file is scraped for alertsThe data is pushed to theTB_EXECUTIONandTB_ALERTStables in MySQL in the project's dbThe row for the project inowaspzaphistoric.TB_PROJECTis updated with recent data to display on the landing pageIt looks for a previous row inTB_EXECUTIONto compare results to and produces a delta reportMore information atowasp-zap-historic-parserStep 4:View results on the OZH app!Click theViewbutton for any project to view its dashboardFrom here, you can click theHistorictab to view all executions for a projectFrom there, you can dive into individual executions to see the ZAP alerts, or click the link to view the published ZAP report, or even delete executionsClicking theAlertstab will show you all alerts for the project, which can be sorted or filtered as needed to help you determine how your application is performing over time.