/** * This script uses the API of ARPSyndicate's Subdomain Center (https://www.subdomain.center/) to * find and add subdomains to the Sites Tree. When it is enabled, it runs automatically for each * new domain added to the Sites Tree. */ const HistoryReference = Java.type("org.parosproxy.paros.model.HistoryReference") const HttpSender = Java.type("org.parosproxy.paros.network.HttpSender") const HttpMessage = Java.type("org.parosproxy.paros.network.HttpMessage") const URI = Java.type("org.apache.commons.httpclient.URI") const requestedSubdomains = [] const sender = new HttpSender(HttpSender.MANUAL_REQUEST_INITIATOR) function invokeWith(msg,as) { var url = msg.getRequestHeader().getURI().toString(); var host = msg.getRequestHeader().getURI().getHost(); domain=right(host,host.indexOf('.')) consumer(domain) } function right(str,chr) { return newstr=str.substr(chr+1,str.length-chr) } function consumer(host) { print('searching for subdomains of ' + host) const apiUri = new URI('https://api.subdomain.center/?domain=' + host, true) const apiMsg = new HttpMessage(apiUri) sender.sendAndReceive(apiMsg) const subdomains = JSON.parse(apiMsg.getResponseBody().toString()) print('found ' + JSON.parse(apiMsg.getResponseBody().toString())) subdomains.forEach(function (subdomain) { const uri = new URI(`https://${subdomain}`, true) const msg = new HttpMessage(uri) const extHistory = control.getExtensionLoader().getExtension("ExtensionHistory") try { sender.sendAndReceive(msg) const href = new HistoryReference(model.getSession(), HistoryReference.TYPE_ZAP_USER, msg) extHistory.addHistory(href) } catch (err) { print(`Failed to send a request to "https://${subdomain}": ${err.getMessage()}.`) } const uri2 = new URI(`http://${subdomain}`, true) const msg2 = new HttpMessage(uri2) const extHistory2 = control.getExtensionLoader().getExtension("ExtensionHistory") try { sender.sendAndReceive(msg2) const href2 = new HistoryReference(model.getSession(), HistoryReference.TYPE_ZAP_USER, msg2) extHistory.addHistory(href2) requestedSubdomains.push(subdomain) } catch (err) { print(`Failed to send a request to "http://${subdomain}": ${err.getMessage()}.`) } }) } function install(helper) { org.zaproxy.zap.ZAP.getEventBus().registerConsumer(consumer, "org.parosproxy.paros.model.SiteMapEventPublisher") } function uninstall(helper) { org.zaproxy.zap.ZAP.getEventBus().unregisterConsumer(consumer) }