WebSocket Scanning

ZAP has good support for websockets, and allows them to be intercepted, changed and fuzzed. However, it doesn't currently support scanning, either passive or active, of websocket messages. Thus, it is necessary to start with an infrastructure that is going to support scans, both active and passive. The infrastructure should handle the addition and removal of plugins, providing appropriate utilities, run in a background thread, may store statistics of scanning, etc. On the other hand, a plugin implements a particular scanning method for a group of vulnerabilities. Script plugin is a special kind of plugin which is used to run scripts which are written by users and consequently processed by different scripting engines. Finally, API is useful for inter-connectivity of ZAP with other applications like ZAP HUD. I proposing a infrastructure which is going to support active and passive scanning. In addition, I am proposing feature which in my way of thinking is essential and plugins which are testing the most critical vulnerabilities.