Automation, Networking, and Cybersecurity.

#!/usr/bin/env bash
set -euo pipefail

# Discover URLs within an authorised target using the OWASP ZAP spider API.
#
# Usage:
#   ./ZAPscan.sh https://example.com
#
# Optional environment variables:
#   TARGET_URL    Target URL if no positional argument is supplied
#   ZAP_BASE_URL  ZAP API base URL (default: http://127.0.0.1:8080)
#   ZAP_API_KEY   ZAP API key, if enabled
#   OUTPUT_FILE   Output file path (default: ./zap-urls.txt)

TARGET_URL="${1:-${TARGET_URL:-}}"
ZAP_BASE_URL="${ZAP_BASE_URL:-http://127.0.0.1:8080}"
OUTPUT_FILE="${OUTPUT_FILE:-./zap-urls.txt}"
ZAP_API_KEY="${ZAP_API_KEY:-}"

usage() {
  cat <<'EOF' >&2
Usage: ./ZAPscan.sh https://example.com

Runs an OWASP ZAP spider against the supplied target and writes a sorted,
deduplicated list of discovered URLs to OUTPUT_FILE.
EOF
  exit 1
}

if [[ -z "$TARGET_URL" ]]; then
  usage
fi

api_url() {
  local path="$1"
  if [[ -n "$ZAP_API_KEY" ]]; then
    printf "%s%s&apikey=%s" "$ZAP_BASE_URL" "$path" "$ZAP_API_KEY"
  else
    printf "%s%s" "$ZAP_BASE_URL" "$path"
  fi
}

json_value() {
  local key="$1"
  python3 -c 'import json,sys; print(json.load(sys.stdin)[sys.argv[1]])' "$key"
}

urlencode() {
  python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$1"
}

echo "Checking ZAP API at $ZAP_BASE_URL ..."
curl -fsS "$(api_url '/JSON/core/view/version/?')" >/dev/null || {
  echo "Could not reach the ZAP API at $ZAP_BASE_URL." >&2
  echo "Start ZAP in desktop or daemon mode and confirm the API is listening." >&2
  exit 1
}

ENCODED_TARGET="$(urlencode "$TARGET_URL")"

echo "Starting spider for $TARGET_URL ..."
SCAN_ID="$(
  curl -fsS "$(api_url "/JSON/spider/action/scan/?url=${ENCODED_TARGET}&recurse=true&subtreeOnly=true&contextName=&userName=")" |
    json_value scan
)"

echo "Spider scan id: $SCAN_ID"

while true; do
  STATUS="$(
    curl -fsS "$(api_url "/JSON/spider/view/status/?scanId=${SCAN_ID}&")" |
      json_value status
  )"
  echo "Spider progress: ${STATUS}%"
  [[ "$STATUS" == "100" ]] && break
  sleep 2
done

echo "Collecting discovered URLs ..."
RESULTS_RESPONSE="$(curl -fsS "$(api_url "/JSON/core/view/urls/?baseurl=${ENCODED_TARGET}&")")"

python3 - "$OUTPUT_FILE" <<'PY' <<<"$RESULTS_RESPONSE"
import json
import sys

output_file = sys.argv[1]
data = json.load(sys.stdin)
urls = sorted(set(data.get("urls", [])))

with open(output_file, "w", encoding="utf-8") as f:
    for url in urls:
        f.write(url + "\n")

print(f"Wrote {len(urls)} URLs to {output_file}")
PY

echo "Done."