I have performed the below steps to capture request/response in ZAP :-

  1. Generate the dynamic certificate in ZAP.
  2. Add the Certificate to the browser (FireFox).
  3. Set the local Proxy to and port to 8090
  4. set the outgoing proxy in connection tab (options-> Connection) to proxy.abc.com and port to 8080

  5. Enter the attacking url in browser after that i am getting below error

Access Denied (authentication_failed)

Your credentials could not be authenticated: "Credentials are missing.". You will not be permitted access until your credentials can be verified. This is typically caused by an incorrect username and/or password, but could also be caused by network problems.

But few urls are able to open with same configuration

If I apply similar settings in Burp the browser(firefox) is able to load the webpage with intercept on/off.

  • Very difficult to say without more information. Can you look at the requests ZAP and Burp are sending and see if anything is different? – Simon Bennetts Nov 2 '17 at 14:06
  • requests are same. With burp i can browse all the sites but with zap only few sites are accessible. – Rick Nov 3 '17 at 5:07
  • Can you provide any more information? You can send it to me directly if you like (psiinon at gmail dot com). If not you'll have to keep investigating it yourself - diagnosing problems with no evidence is kind of hard ;) – Simon Bennetts Nov 3 '17 at 9:27
  • one thing i noticed in ZAP :- Connection: keep-alive Cache-Control: max-age=0 and in Burp Connection: close – Rick Nov 3 '17 at 11:00
  • That Connection: header won't mess up your proxy. Dimes to donuts, it's your upstream outgoing proxy. Can you test on something local? Check what authentication method are you using for the outgoing proxy. – mattymcfatty Nov 7 '17 at 20:22

Set the Proxy chain and authentication in Options->Connection

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.