Skip to content

HelpAddonsBeanshellBeanshell

Jump to bottom
psiinon edited this page May 7, 2015 · 4 revisions

Bean Shell Console

The BeanShell is an interactive Java shell that can be used to execute BeanShell scripts. These scripts are a simplified form of Java that use many elements from Java syntax, but in a simpler scripting format. All Java code is also valid BeanShell code.
BeanShell integration in OWASP ZAP enables you to write scripts
using the ZAP functions and data set. This can be a very powerful feature for analyzing web applications.

BeanShell Console

The console is started from the Tools menu, and contains a split screen where the top half is the interactive
BeanShell console and the bottom half is a simple text editor. For complex scripts, you're encouraged
to use a Java editor. Scripts can be loaded, saved and evaluated from the editor. When the BeanShell
starts a number of objects from ZAP are available for use, namely:

  • the Model singleton, through the object named model
  • the SiteTree tree of current sites through the sites object
  • an instance of 
    HttpSender
    through the sender object
    Notice that the BeanShell is loosely typed. Therefore, it is not necessary to declare variables before
    using them – this makes scripts a bit more concise than regular Java. But of course, if you did want
    to define the type you can.

    Using the Site Map

Let's start with something useful and typical: Iterate through all the site nodes and check for the existence
of a file. A script has already been created that accomplishes this, choose Load and select the example.tree.bsh
file. Before clicking Evaluate, first browse to a site through ZAP to populate the tree:

Now click on
evaluate to execute the script that's in the editor. If there are no errors, then you can now start using
the object defined in the script by issuing these commands:

t = Tree();

Which constructs a new Tree object and assigns a reference to t.

t.find(sites.getRoot(), "index.html");

Call the find method on t, which takes a SiteNode as the first argument and a resource to find as the
second. In this case, the method will iterate through all the nodes in the tree, because we started at
the root, and will find index.html files.

Instead of iterating through all the nodes, we could choose
to start a specific node by using the findChild method e.g.:

This should give you some idea of the power
of the BeanShell in ZAP. But to fully exploit it, you'll need to familiarize yourself with the internal
API and the BeanShell's features. The BeanShell has been setup so as to allow full access to all internal
objects and methods – even private ones.

Simple HTTP Request

In the next example, we create and send an HTTP request directly in the interactive console: To fully
utilize the power of the BeanShell, you should familiarize yourself with ZAP's internals. The sender
object is the same instance as is used by the Manual Request Editor and will therefore automatically
use proxy settings set in the ZAP configuration.

TODO: POST example

Tips

Use the unset(String) command to unset any declared variables, methods or objects. This is useful if
you want to replace a method declaration in the current namespace. Note that the command takes a String
argument, not an Object, so to unset the t object we used above, it should be: unset(“t”); and not unset(t);


Original document by: Stephen de Vries

Clone this wiki locally