I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords. But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint and non clickable.
How do I activate it?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Can't fuzz in Safe Mode. Core help info on modes here: https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsModes
ZAP has a 'mode' which can be:
- Safe - no potentially dangerous operations permitted
- Protected - you can only perform (potentially) dangerous actions on URLs in the Scope
- Standard - as in previous releases, you can do anything
- ATTACK - new nodes that are in Scope are actively scanned as soon as they are discovered
It is recommended that you use the Protected mode to ensure that you only attack sites that you mean to.
The mode can be changed via the toolbar (or the ZAP API) and is persisted between sessions.
Examples of the things that will not be possible in either Safe mode or in Protected mode when not acting on URLs in the Scope:
- Active Scanning
- Force Browsing
- Breaking (intercepting)
- Resending requests