7

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the Authorization header included in my HTTP request. I want to include the authentication details in scan properties ahead of the scan. Please let me know how to do it in OWASP ZAP.

This link may help in answering my question.

Improve this question

1 Answer 1

Reset to default
4

You need to add your app to a Context and then set up HTTP Authentication for it: https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsAuthentication#httpntlm-authentication

Improve this answer
2
  • When I right click and go to "Flag as Context", I got option for "Default Context: Form-based Auth Login Request". I switch it to "HTTP/NTLM Authentication" and provide Hostname, Port, Realm and Regex Pattern for logged in and logged out response messages. What I am not able to understand is that where does the ZAP keeps/shows the credentials?
    – Krishna Pandey
    Nov 4, 2015 at 10:42
  • 2
    ZAP stores the credentials in its session, which is an HSQLDB database. If you persist that session and reload it at a later date then it will still have the credentials. You can also export and import Contexts, which will also include the credentials, but wont include all of the history and issues from the session - these are just config files.
    – Simon Bennetts
    Nov 10, 2015 at 10:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .