zaproxy icon indicating copy to clipboard operation
zaproxy copied to clipboard

zap-full-scan Report File is not written after full scan completes. No errors reported in the console. baseline scan works fine.

Open chaoscode opened this issue 11 months ago • 4 comments

Describe the bug

When running the report file is not written

Steps to reproduce the behavior

1: install docker desktop 2: run docker (docker run -v C:\user{username}\Desktop\Work:/zap/wrk/:rw -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py -t https://www.{domain}.com/ -j {domain}_Full_report.json -g gen.conf -quickprogress -v) 3: observe no report file is written to the mounted path

Expected behavior

the file is written or the console outputs an error message explaining what happened

Software versions

I have tried docker desktop and TrueNAS Scale with this and the latest tag. I have the same issue. The file will not write to a mount. I am using quite a few other scanners that all mount to this folder, and they are able to write the report files just fine.

Screenshots

image

Errors from the zap.log file

no log file exists in the home directory.

Additional context

I have used the touch command per the documentation to confirm that files are touched, and no errors are output by the console.

I have no issues with running the baseline scan and getting the report to write from the same docker.

Would you like to help fix this issue?

  • [ ] Yes

chaoscode avatar Mar 15 '24 13:03 chaoscode

Exclude the -g, you shouldn't be generating the config on every run: https://www.zaproxy.org/docs/docker/full-scan/#usage

Also quickprogress because you aren't using quickscan you're using a packaged scan.

kingthorin avatar Mar 15 '24 14:03 kingthorin

Just to confirm it's a typo, did you mean to use -J (instead of -j)?

thc202 avatar Mar 15 '24 14:03 thc202

In any case we should definitely error on invalid command line args.

thc202 avatar Mar 15 '24 14:03 thc202

no log file exists in the home directory.

Nor should it. (ZAP home, not user home.) https://www.zaproxy.org/faq/how-do-you-configure-zap-logging/

ZAP logs to a file called “zap.log” in the ZAP ‘home’ directory.

kingthorin avatar Mar 15 '24 14:03 kingthorin