3

I tried using the web proxy functionality of OWASP Zed Attack Proxy (ZAP) to edit the response JavaScript and HTML. I tried to make a button get the attribute disable="false" instead of disable="". I can easily use the Firebug console to achieve this.

However, I want to use ZAP instead, and I set a breakpoint at the response, edited the HTML and JavaScript that I want. When I press submit, the changes made have no effect. Am I missing some JavaScript that again disables the button after the page is loaded, or is ZAP not working this way at all? Anyone with experience in using ZAP that knows if similar stuff works for them?

I did a simple test. I edited the response body to be empty. This gave no result so I guess ZAP lacks the functionality I'm looking for here? The fault was then not due to some background JavaScript.

About the comment. I do not have a reputation high enough to post an answer to my own question. If someone know how to use ZAP for editing http responses I would be glad to hear it. It seams to me like its not working but ZAP gives the user the impression that it should be working. Please confirm my suspicion(that this functionality do not exist) or answer how to do it.

The

Improve this question
1
  • 2
    If you solved the problem you had on your own, then please post it as an answer to your question, and not include it in your question body. This way, others that might experience same problem will be able to find the answer they're looking for easier. You can accept your own answer, if you think you've solved your problem to a satisfactory level and indeed answers your question, or leave it unaccepted, if you require input on the matter from others too. Thanks!
    – TildalWave
    Commented Aug 2, 2013 at 3:14

1 Answer 1

Reset to default
2

ZAP definitely supports this functionality :)

If you just want to enable disabled buttons then you can click on the 'Show / enable fields' button (the lightbulb one) on the toolbar (which will 'light up') and then reload the page in your browser.

If you want to edit the response then the easiest option is to click on the 'Set break on all responses' button (left green arrow) on the toolbar (which will become red) and refresh the page. The page will then be held in the 'Break' tab. You can then make any changes you want before sending them on to your browser using the 'Submit and continue..' or 'Submit and step..' buttons. Note that ZAP will continue intercepting responses until you turn the relevant button off.

Note that we do have a ZAP User Group which is linked off the 'Online' menu - you may well get faster and more knowledgeable answers on that ;)

Simon (ZAP Project Lead)

Improve this answer
4
  • Okey, thanks. I have problems using this feature. I break my responses, (left arrow pressed, turned red). Then I change in the text inside break and then I submit. Firefox do not display any differences. Maybe its something wrong with the way I set proxy. Changing the request does have effect.
    – David from earth
    Commented Aug 4, 2013 at 16:37
  • If you close ZAP do you still get the responses in Firefox? If so then you are not proxying via ZAP. If it fails to connect then you probably are ;) I've just sanity checked this and it works fine for me on the latest code. What version are you using?
    – Simon Bennetts
    Commented Aug 5, 2013 at 13:14
  • Its working, probably I just got confused trying to manipulate an SSL connection without using a certificate. Thank you for your help:)
    – David from earth
    Commented Aug 5, 2013 at 14:15
  • No problem! I try to keep an eye on all the forums out there (and fail, obviously) so the ZAP user group groups.google.com/group/zaproxy-users is the best way to get answers to these sort of questions ;)
    – Simon Bennetts
    Commented Aug 5, 2013 at 17:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .