[Tracker] Passive Scanning WebSockets

Expectations

An infrastructure which allows passively examination of WebSocket messages. The infrastructure should support plugin additions, scripts and API, all the above should be able to raise the appropriate alerts.

Current State
Has been released

TODOs

• Support Plugin Addition
  • Usable UI
• API
• Make alerts trigger ZAP-HUD pop-ups (related issue [2])

Done

• Add forder to Community Script Repo (PR#156)
• Fix the errors triggered by using websocket passive scanner with ZAP HUD (more-info) (Fixed)
• Add WebSocket Passive Scan scripts by default
• PR#1718 Script Mechanism
  Contains:
  • Basic infrastructure - Iterates over the stored websocket messages and, in turn, apply the passive script plugin
  • Templates for Python and JavaScript
  • Scripts are able to raise alerts. However, because of related issue 1 the alerts point on handshake message.

Possible Scans

• Scripts
  • Base64 Disclosure - Javascript
    • PR#2088
  • Email Disclosure - Javascript
    • PR#2090
  • Error Messages Disclosure - Javascript
    • PR#2091
  • Private IP Disclosure - Javascript
    • PR#2092
  • Credit Card Disclosure - Javascript
    • PR#2093
  • Username Scanner - Javascript
    • PR#2096
  • Debug Error Disclosure - Javascript
    • PR#2099
  • Suspicious Comment Disclosure - Javascript
    • PR#2098

Related Issues

1. Enhancement: Add support for raising alerts for other than HTTP/1.x interactions
2. Default to showing alerts for different subdomains
3. Alerts can't handle huge payloads and evidence
4. Base64 Disclosure rule for WebSocket
5. WebSocket default scipts behaviour
6. WebSocketAlertWrapper - Couldn't get the Handshake Http Message for this specific channel