Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I tried using the web proxy functionality of OWASP Zed Attack Proxy (ZAP) to edit the response JavaScript and HTML. I tried to make a button get the attribute disable="false" instead of disable="". I can easily use the Firebug console to achieve this.

However, I want to use ZAP instead, and I set a breakpoint at the response, edited the HTML and JavaScript that I want. When I press submit, the changes made have no effect. Am I missing some JavaScript that again disables the button after the page is loaded, or is ZAP not working this way at all? Anyone with experience in using ZAP that knows if similar stuff works for them?


I did a simple test. I edited the response body to be empty. This gave no result so I guess ZAP lacks the functionality I'm looking for here? The fault was then not due to some background JavaScript.

About the comment. I do not have a reputation high enough to post an answer to my own question. If someone know how to use ZAP for editing http responses I would be glad to hear it. It seams to me like its not working but ZAP gives the user the impression that it should be working. Please confirm my suspicion(that this functionality do not exist) or answer how to do it.

The

share|improve this question
2  
If you solved the problem you had on your own, then please post it as an answer to your question, and not include it in your question body. This way, others that might experience same problem will be able to find the answer they're looking for easier. You can accept your own answer, if you think you've solved your problem to a satisfactory level and indeed answers your question, or leave it unaccepted, if you require input on the matter from others too. Thanks! –  TildalWave Aug 2 '13 at 3:14

1 Answer 1

up vote 1 down vote accepted

ZAP definitely supports this functionality :)

If you just want to enable disabled buttons then you can click on the 'Show / enable fields' button (the lightbulb one) on the toolbar (which will 'light up') and then reload the page in your browser.

If you want to edit the response then the easiest option is to click on the 'Set break on all responses' button (left green arrow) on the toolbar (which will become red) and refresh the page. The page will then be held in the 'Break' tab. You can then make any changes you want before sending them on to your browser using the 'Submit and continue..' or 'Submit and step..' buttons. Note that ZAP will continue intercepting responses until you turn the relevant button off.

Note that we do have a ZAP User Group which is linked off the 'Online' menu - you may well get faster and more knowledgeable answers on that ;)

Simon (ZAP Project Lead)

share|improve this answer
    
Okey, thanks. I have problems using this feature. I break my responses, (left arrow pressed, turned red). Then I change in the text inside break and then I submit. Firefox do not display any differences. Maybe its something wrong with the way I set proxy. Changing the request does have effect. –  David from earth Aug 4 '13 at 16:37
    
If you close ZAP do you still get the responses in Firefox? If so then you are not proxying via ZAP. If it fails to connect then you probably are ;) I've just sanity checked this and it works fine for me on the latest code. What version are you using? –  Psiinon Aug 5 '13 at 13:14
    
Its working, probably I just got confused trying to manipulate an SSL connection without using a certificate. Thank you for your help:) –  David from earth Aug 5 '13 at 14:15
    
No problem! I try to keep an eye on all the forums out there (and fail, obviously) so the ZAP user group groups.google.com/group/zaproxy-users is the best way to get answers to these sort of questions ;) –  Psiinon Aug 5 '13 at 17:11
    
Okey good to know, thanks:) –  David from earth Aug 5 '13 at 17:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.