My First Lines of Code for CherryBomb ZAP extension

“The journey of a thousand miles begins with a single step.” Lao Tzu

Zap is written in JAVA, so I chose eclipse as my IDE. I will explain how I began to code the first line, but before ensure that you have the repo of zap cloned, and the simpleexample of zap imported into eclipse, for more info please check my previous article https://dev.to/nathan20/zap-add-ons-the-first-step-4bf3.
I renamed all the class file of simpleexample to cherrybomb.

I wrote the first lines to the ExtensionCherryBomb following this path zap-extensions/addOns/cherrybomb/src/main/java/org/zaproxy/addon/cherrybomb,then put my code bellow the comment as described in the picture.

I divided my project into several part, and the first one was to collect the Logs from the history tab.
How the history tab should looks in ZAP.

In the beginning I thought that I should use the API of zap in order to access the element in the app-front, but after a little bit research on zap developer's group, I understood that there is a documentation for zap's developer. https://javadoc.io/doc/org.zaproxy/zap/latest/index.html.
At my first look at the documentation I felt a little bit confuse and overwhelmed, and I did not know from where to begin.

Thank to community scripts! I found this repo in the ZAP github's page https://github.com/zaproxy/community-scripts/blob/main/standalone/. There was this interesting script written in JS for access to the history tab.
extHist = org.parosproxy.paros.control.Control.getSingleton().
getExtensionLoader().getExtension(
org.parosproxy.paros.extension.history.ExtensionHistory.NAME)
if (extHist != null) {
i=1
lastRef=extHist.getLastHistoryId();// Get current max history reference
// Loop through the history table, printing out the history id and the URL
while (i <= lastRef) {
hr = extHist.getHistoryReference(i)
if (hr) {
url = hr.getHttpMessage().getRequestHeader().getURI().toString();
print('Got History record id ' + hr.getHistoryId() + ' URL=' + url);
}
i++
}
}
From there I got a little idea from where I need to search in documentation and which class I should use.
The method and class should remain approximately the same (https://javadoc.io/doc/org.zaproxy/zap/latest/index.html).
I created an instance of the ExtensionHistory class and apply the method getLastHistoryId() in order to get the last history id.
ExtensionHistory history1 = new ExtensionHistory();
int lastRef = history1.getLastHistoryId();

Remember my goal at this moment, is to collect logs from a specific host (that the user will choose), then insert them into an JSON object compress it finally send it to a endpoint(company server).
I created a function CreateJsonFromLogs that receive a string parameter the Website chosen by the client. The purpose of the function is to loop over all history, put into an array JSON the correct request and response into JSON object.
Take a look how our logs looks likes https://www.blstsecurity.com/cherrybomb/Documentation#structure.

You will ask How I get the request/response?

So after some search in the documentation, I found an interesting interface called HistoryReferencesTableEntry.
DefaultHistoryRefenrencesTableEntry is an implementing class of this interface.

Was no easy to get the hostname and Uri.
But with the help of DefaultHistoryReferencesTableEntry class I got the possibility to access the values of columns in the history table.


DefaultHistoryReferencesTableEntry table = new DefaultHistoryReferencesTableEntry(history, HistoryReferencesTableModel.Column.values());
}


table.getHostName()
table.getUri()


Then I operated several checks if the url does not contain png or others formats, and verifiy that the Content-type is html.
Finally after loop finished running, the function return the json object.

You can check my entire function for more details.

private JSONObject CreateJsonFromLogs(String website) {
         JSONObject json = new JSONObject();
         ExtensionHistory history1 = new ExtensionHistory();
         int lastRef = history1.getLastHistoryId();
         JSONArray array = new JSONArray();
         for ( int x = 1;  x <= lastRef ; x++) {
             try {
                    JSONObject item = new JSONObject();
                HistoryReference history = new HistoryReference(x);
                HttpMessage http_mess = new HttpMessage(history.getHttpMessage());
                    DefaultHistoryReferencesTableEntry table = new DefaultHistoryReferencesTableEntry(history, HistoryReferencesTableModel.Column.values());
                if(table.getHostName().equals(website)) {
                    ExtensionCherryBomb.website_exist = true;
                if (!table.getUri().contains(".jsp") && !table.getUri().contains(".css") && !table.getUri().contains(".js") && !table.getUri().contains(".html") && !table.getUri().contains(".ico")  && !table.getUri().contains(".png")) {
                        if (!http_mess.getResponseHeader().toString().contains("Content-Type: text/html")) {
                                item.put("request",http_mess.getRequestHeader().toString());
                            item.put("response",http_mess.getResponseHeader().toString() );
                                        array.add(item);
                        }

                    }
                }
             }


        catch (HttpMalformedHeaderException | DatabaseException | JSONException e1) {
            e1.printStackTrace();
        }


        try {
            json.put("session",array);
                ExtensionCherryBomb.message = json.toString();


              }

         catch (JSONException e1) {
            e1.printStackTrace();
        }


         }

         return json;

        }

I will meet you for the next step of development.

(Me after finished to write the first function 😂)

Cherrybomb's github:https://github.com/blst-security/cherrybomb
ZAProxy's github:https://github.com/zaproxy
ZAP official website:https://www.zaproxy.org/