1

I am looking to PEN test my application against XSS attacks.

The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET /cart.

So far I have figured out how to successfully use Fuzzer to make XSS attacks to my application.

However it expects the response to contain the data it just submitted.

I guess what I need is a two step approach to Fuzzer.

  1. Make attack request to POST /cart/add
  2. Assert if attack was successful by requesting GET /cart

Does anyone know how I can do this?

Improve this question

1 Answer 1

Reset to default
1

Is your application returning HTML when you GET /cart ? If it is then you could try using the ZAP persistent XSS scanner - that should inject XSS attacks via the POST and then check all of the URLs where the payload is displayed.

If the GET doesnt return html then it all depends how that data gets used.

FYI we have a ZAP Users group which is probably more suitable for questions like this: http://groups.google.com/group/zaproxy-users Thats linked off the ZAP "Online / ZAP User Group" menu item, which is apparently invisible as no one seems to spot it ;)

Simon (ZAP Project Lead)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .