Plugin (OWASP Zed Attack Proxy)

All Superinterfaces:

ExampleAlertProvider, Runnable

All Known Implementing Classes:

AbstractAppParamPlugin, AbstractAppPlugin, AbstractDefaultFilePlugin, AbstractHostPlugin, AbstractPlugin, ScriptsActiveScanner
```
public interface Plugin
extends Runnable, ExampleAlertProvider
```
This interface must be implemented by a Plugin for running the checks. The AbstractHostPlugin, AbstractAppPlugin, AbstractAppParamPlugin implement this interface and is a good starting point for writing new plugins.

Nested Class Summary

Nested Classes
Modifier and Type Interface and Description

static class Plugin.AlertThreshold

static class Plugin.AttackStrength

Nested Classes
Modifier and Type	Interface and Description
`static class`	`Plugin.AlertThreshold`
`static class`	`Plugin.AttackStrength`

Method Summary

All Methods Instance Methods Abstract Methods Default Methods
Modifier and Type	Method and Description
`void`	`cloneInto(Plugin plugin)`
`void`	`createParamIfNotExist()`
`default Map<String,String>`	`getAlertTags()` Gets the tags attached to the alerts raised by this plugin.
`Plugin.AlertThreshold`	`getAlertThreshold()` The alert threshold for this plugin, i.e.
`Plugin.AlertThreshold`	`getAlertThreshold(boolean incDefault)` The alert threshold for this plugin, i.e.
`Plugin.AlertThreshold[]`	`getAlertThresholdsSupported()` Returns an array of the AlertThresholds supported.
`Plugin.AttackStrength`	`getAttackStrength()` Returns the AttackStrength, which is an indication of the relative number of requests the plugin will make against a given target.
`Plugin.AttackStrength`	`getAttackStrength(boolean incDefault)` Returns the AttackStrength, which is an indication of the relative number of requests the plugin will make against a given target
`Plugin.AttackStrength[]`	`getAttackStrengthsSupported()` Returns an array of the AttackStrengths supported.
`int`	`getCategory()` Gets the category of this scanner.
`String`	`getCodeName()` Code name is the plugin name used for dependency naming.
`org.apache.commons.configuration.Configuration`	`getConfig()`
`int`	`getCweId()` Gets the CWE ID of the issue(s) raised by the scanner.
`int`	`getDelayInMs()`
`String[]`	`getDependency()` The `names` of dependencies of the plugin.
`String`	`getDescription()` Default description of this plugin.
`default List<Alert>`	`getExampleAlerts()` Gets a list of example alerts that the plugin can raise.
`int`	`getId()` Unique Paros ID of this plugin.
`String`	`getName()` Plugin name.
`String`	`getReference()` Reference document provided by this plugin.
`int`	`getRisk()` Gets the highest risk level of the alerts raised by the plugin.
`String`	`getSolution()` Default solution returned by this plugin.
`AddOn.Status`	`getStatus()` Gets the status of the plugin (as given by the corresponding add-on).
`Date`	`getTimeFinished()`
`Date`	`getTimeStarted()`
`int`	`getWascId()` Gets the WASC ID of the issue(s) raised by the scanner.
`void`	`init(HttpMessage msg, HostProcess parent)` Initialises the plugin with the given message and host process.
`boolean`	`inScope(Tech tech)` Tells whether or not the given technology is enabled for the scan.
`boolean`	`isDepreciated()`
`boolean`	`isEnabled()` Tells whether or not the scanner is enabled.
`boolean`	`isVisible()` Tells whether or not the scanner can be selected and should be shown..
`void`	`loadFrom(org.apache.commons.configuration.Configuration conf)`
`void`	`notifyPluginCompleted(HostProcess parent)` Plugin must implement this to notify when completed.
`void`	`saveTo(org.apache.commons.configuration.Configuration conf)`
`void`	`scan()` Scans the target server using the message previously set during initialisation.
`void`	`setAlertThreshold(Plugin.AlertThreshold level)` Set the alert threshold for this plugin, i.e.
`void`	`setAttackStrength(Plugin.AttackStrength level)` Set the attack strength for this plugin, i.e.
`void`	`setConfig(org.apache.commons.configuration.Configuration config)`
`void`	`setDefaultAlertThreshold(Plugin.AlertThreshold level)` Set the default alert threshold for this plugin, i.e.
`void`	`setDefaultAttackStrength(Plugin.AttackStrength strength)` Set the default attack strength for this plugin, i.e.
`void`	`setDelayInMs(int delay)`
`void`	`setEnabled(boolean enabled)` Sets whether or not the scanner is enabled.
`void`	`setTechSet(TechSet ts)` Sets the technologies enabled for the scan.
`void`	`setTimeFinished()`
`void`	`setTimeStarted()`
`boolean`	`targets(TechSet technologies)` Tells whether or not the scanner targets the given `technologies` to be run.

Methods inherited from interface java.lang.Runnable
run

- Method Detail
  - getId
```
int getId()
```
    Unique Paros ID of this plugin.
    
    Returns:
    
    the ID
  - getName
```
String getName()
```
    Plugin name. This is the human readable plugin name for display.
    
    Returns:
    
    the internationalised name
  - getCodeName
```
String getCodeName()
```
    Code name is the plugin name used for dependency naming. By default this is the class name (without the package prefix).
    
    Returns:
    
    the internal name
  - getDescription
```
String getDescription()
```
    Default description of this plugin.
    
    Returns:
    
    the description
  - getRisk
```
int getRisk()
```
    Gets the highest risk level of the alerts raised by the plugin.
    
    Returns:
    
    the highest risk level of the alerts raised by the plugin.
    
    Since:
    
    2.0.0
    
    See Also:
    
    Alert.RISK_HIGH, Alert.RISK_MEDIUM, Alert.RISK_LOW, Alert.RISK_INFO
  - init
```
void init(HttpMessage msg,
          HostProcess parent)
```
    Initialises the plugin with the given message and host process.
    
    Parameters:
    
    msg - the message to be scanned.
    
    parent - the parent host process.
  - scan
```
void scan()
```
    Scans the target server using the message previously set during initialisation.
    
    See Also:
    
    init(HttpMessage, HostProcess)
  - getDependency
```
String[] getDependency()
```
    The names of dependencies of the plugin.
    The plugin will not run if the dependencies are not fulfilled nor run.
    
    Returns:
    
    an array with the names of the dependencies, or null/empty if none.
  - setEnabled
```
void setEnabled(boolean enabled)
```
    Sets whether or not the scanner is enabled.
    
    Parameters:
    
    enabled - true if the scanner should be enabled, false otherwise
  - isEnabled
```
boolean isEnabled()
```
    Tells whether or not the scanner is enabled.
    
    Returns:
    
    true if the scanner is enabled, false otherwise
  - getCategory
```
int getCategory()
```
    Gets the category of this scanner.
    
    Returns:
    
    the category of the scanner
    
    See Also:
    
    Category
  - getSolution
```
String getSolution()
```
    Default solution returned by this plugin.
    
    Returns:
    
    the solution
  - getReference
```
String getReference()
```
    Reference document provided by this plugin.
    
    Returns:
    
    the references
  - getAlertTags
```
default Map<String,String> getAlertTags()
```
    Gets the tags attached to the alerts raised by this plugin.
    
    Returns:
    
    the alert tags
    
    Since:
    
    2.11.0
  - notifyPluginCompleted
```
void notifyPluginCompleted(HostProcess parent)
```
    Plugin must implement this to notify when completed.
    
    Parameters:
    
    parent - the parent HostProcess
  - isVisible
```
boolean isVisible()
```
    Tells whether or not the scanner can be selected and should be shown..
    
    Returns:
    
    true if the scanner is visible, false otherwise
  - setConfig
```
void setConfig(org.apache.commons.configuration.Configuration config)
```
  - getConfig
```
org.apache.commons.configuration.Configuration getConfig()
```
  - saveTo
```
void saveTo(org.apache.commons.configuration.Configuration conf)
```
  - loadFrom
```
void loadFrom(org.apache.commons.configuration.Configuration conf)
```
  - cloneInto
```
void cloneInto(Plugin plugin)
```
  - createParamIfNotExist
```
void createParamIfNotExist()
```
  - isDepreciated
```
boolean isDepreciated()
```
  - getDelayInMs
```
int getDelayInMs()
```
  - setDelayInMs
```
void setDelayInMs(int delay)
```
  - getAlertThreshold
```
Plugin.AlertThreshold getAlertThreshold(boolean incDefault)
```
    The alert threshold for this plugin, i.e. the level of certainty required to report an alert
    
    Parameters:
    
    incDefault - if the DEFAULT level should be returned as DEFAULT as opposed to the value of the default level
    
    Returns:
    
    The alert threshold currently set for this plugin
  - getAlertThreshold
```
Plugin.AlertThreshold getAlertThreshold()
```
    The alert threshold for this plugin, i.e. the level of certainty required to report an alert. The DEFAULT level will not be returned, instead the value of the default level will be returned, if relevant.
    
    Returns:
    
    The alert threshold for this plugin
  - setAlertThreshold
```
void setAlertThreshold(Plugin.AlertThreshold level)
```
    Set the alert threshold for this plugin, i.e. the level of certainty required to report an alert
    
    Parameters:
    
    level - The alert threshold to set for this plugin
  - setDefaultAlertThreshold
```
void setDefaultAlertThreshold(Plugin.AlertThreshold level)
```
    Set the default alert threshold for this plugin, i.e. the level of certainty required to report an alert
    
    Parameters:
    
    level - The alert threshold to set for this plugin
  - getAlertThresholdsSupported
```
Plugin.AlertThreshold[] getAlertThresholdsSupported()
```
    Returns an array of the AlertThresholds supported. It must include MEDIUM and may include LOW and HIGH OFF and DEFAULT are assumed and should not be returned.
    
    Returns:
    
    an array containing the attack thresholds supported
  - getAttackStrength
```
Plugin.AttackStrength getAttackStrength(boolean incDefault)
```
    Returns the AttackStrength, which is an indication of the relative number of requests the plugin will make against a given target
    
    Parameters:
    
    incDefault - if the DEFAULT level should be returned as DEFAULT as opposed to the value of the default level
    
    Returns:
    
    The AttackStrength currently set for this plugin
  - getAttackStrength
```
Plugin.AttackStrength getAttackStrength()
```
    Returns the AttackStrength, which is an indication of the relative number of requests the plugin will make against a given target. The DEFAULT level will not be returned, instead the value of the default level will be returned, if relevant.
    
    Returns:
    
    The AttackStrength currently set for this plugin
  - setAttackStrength
```
void setAttackStrength(Plugin.AttackStrength level)
```
    Set the attack strength for this plugin, i.e. the relative number of requests the plugin will make against a given target.
    
    Parameters:
    
    level - The alert threshold to set for this plugin
  - setDefaultAttackStrength
```
void setDefaultAttackStrength(Plugin.AttackStrength strength)
```
    Set the default attack strength for this plugin, i.e. the relative number of attacks that will be performed
    
    Parameters:
    
    strength - The attack strength to set for this plugin
  - getAttackStrengthsSupported
```
Plugin.AttackStrength[] getAttackStrengthsSupported()
```
    Returns an array of the AttackStrengths supported. It must include MEDIUM and may include LOW, HIGH and INSANE. DEFAULT is assumed and should not be returned.
    
    Returns:
    
    an array containing the attack strengths supported
  - setTechSet
```
void setTechSet(TechSet ts)
```
    Sets the technologies enabled for the scan.
    Called before initialising the plugin.
    
    Parameters:
    
    ts - the technologies enabled for the scan
    
    Throws:
    
    IllegalArgumentException - (since 2.6.0) if the given parameter is null.
    
    Since:
    
    2.0.0
    
    See Also:
    
    targets(TechSet)
  - inScope
```
boolean inScope(Tech tech)
```
    Tells whether or not the given technology is enabled for the scan.
    Helper method to check if a technology is enabled before performing a test/scan.
    
    Parameters:
    
    tech - the technology that will be checked
    
    Returns:
    
    true if the technology is enabled for the scan, false otherwise
    
    Since:
    
    2.0.0
    
    See Also:
    
    targets(TechSet)
  - targets
```
boolean targets(TechSet technologies)
```
    Tells whether or not the scanner targets the given technologies to be run. If the scanner does not target a specific technology is should return, always, true so the scanner is run independently of the technologies enabled.
    Scanners that target multiple technologies must check which technologies are enabled before performing the actual scans.
    
    Parameters:
    
    technologies - the technologies that are enabled for the scan, never null
    
    Returns:
    
    true if the scanner is targeting the given technologies (or none at all), false otherwise
    
    Since:
    
    2.4.1
    
    See Also:
    
    setTechSet(TechSet), inScope(Tech)
  - setTimeStarted
```
void setTimeStarted()
```
  - getTimeStarted
```
Date getTimeStarted()
```
  - setTimeFinished
```
void setTimeFinished()
```
  - getTimeFinished
```
Date getTimeFinished()
```
  - getCweId
```
int getCweId()
```
    Gets the CWE ID of the issue(s) raised by the scanner.
    
    Returns:
    
    the CWE ID, -1 if unknown.
    
    Since:
    
    2.2.0
    
    See Also:
    
    CWE - Common Weakness Enumeration
  - getWascId
```
int getWascId()
```
    Gets the WASC ID of the issue(s) raised by the scanner.
    
    Returns:
    
    the WASC ID, -1 if unknown.
    
    Since:
    
    2.2.0
    
    See Also:
    
    The WASC Threat Classification
  - getStatus
```
AddOn.Status getStatus()
```
    Gets the status of the plugin (as given by the corresponding add-on).
    The status is automatically set by core code during initialisation.
    
    Returns:
    
    the status of the plugin.
    
    Since:
    
    2.4.0
  - getExampleAlerts
```
default List<Alert> getExampleAlerts()
```
    Gets a list of example alerts that the plugin can raise.
    
    Specified by:
    
    getExampleAlerts in interface ExampleAlertProvider
    
    Since:
    
    2.10.0

Interface Plugin

Nested Class Summary

Method Summary

Methods inherited from interface java.lang.Runnable

Method Detail

getId

getName

getCodeName

getDescription

getRisk

init

scan

getDependency

setEnabled

isEnabled

getCategory

getSolution

getReference

getAlertTags

notifyPluginCompleted

isVisible

setConfig

getConfig

saveTo

loadFrom

cloneInto

createParamIfNotExist

isDepreciated

getDelayInMs

setDelayInMs

getAlertThreshold

getAlertThreshold

setAlertThreshold

setDefaultAlertThreshold

getAlertThresholdsSupported

getAttackStrength

getAttackStrength

setAttackStrength

setDefaultAttackStrength

getAttackStrengthsSupported

setTechSet

inScope

targets

setTimeStarted

getTimeStarted

setTimeFinished

getTimeFinished

getCweId

getWascId

getStatus

getExampleAlerts