Setting up OWASP ZAP Authentication against 2 page forms authenication

Question

My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I Zap forms-based authentication for a scenario like this? Is it doable?

Answer 1

You can also try script-based authentication as the first measure: record an auth script in Zap UI (from the point where you login to the website), click Run when you are done recording to check if it actually logs in. If it does, profit.

Answer 2

Maybe you can achieve that integrating ZAP with testing/automation tools. Check out this:

https://medium.com/@abhaybhargav/integrating-e2e-and-application-security-testing-howto-with-nightwatchjs-and-owasp-zap-8240c540c524

For scanning microservices with token based authentication, the workaround is very different. If you need assistance with something like that, I could give you a more detailed solution.

Answer 3

There is a way to do this, it's too long to write as a comment but I will send a link to a blog post that I wrote two year ago.

Go to the section Setting up an active scan where I've written out the steps involved to scan a page with authentication. You may be able to do both, as long as the steps are followed but you have the same cookie/s?

Alternatively there is a owasp zaproxy user guide on Google which have been helpful.