1

I have performed the below steps to capture request/response in ZAP :-

  1. Generate the dynamic certificate in ZAP.
  2. Add the Certificate to the browser (FireFox).
  3. Set the local Proxy to 127.0.0.1 and port to 8090

  4. set the outgoing proxy in connection tab (options-> Connection) to proxy.abc.com and port to 8080

  5. Enter the attacking url in browser after that i am getting below error

Access Denied (authentication_failed)

Your credentials could not be authenticated: "Credentials are missing.". You will not be permitted access until your credentials can be verified. This is typically caused by an incorrect username and/or password, but could also be caused by network problems.

But few urls are able to open with same configuration

If I apply similar settings in Burp the browser(firefox) is able to load the webpage with intercept on/off.

Improve this question
6
  • Very difficult to say without more information. Can you look at the requests ZAP and Burp are sending and see if anything is different?
    – Simon Bennetts
    Nov 2, 2017 at 14:06
  • requests are same. With burp i can browse all the sites but with zap only few sites are accessible.
    – Rick
    Nov 3, 2017 at 5:07
  • Can you provide any more information? You can send it to me directly if you like (psiinon at gmail dot com). If not you'll have to keep investigating it yourself - diagnosing problems with no evidence is kind of hard ;)
    – Simon Bennetts
    Nov 3, 2017 at 9:27
  • one thing i noticed in ZAP :- Connection: keep-alive Cache-Control: max-age=0 and in Burp Connection: close
    – Rick
    Nov 3, 2017 at 11:00
  • That Connection: header won't mess up your proxy. Dimes to donuts, it's your upstream outgoing proxy. Can you test on something local? Check what authentication method are you using for the outgoing proxy.
    – MattyMcFatty
    Nov 7, 2017 at 20:22

1 Answer 1

Reset to default
0

Set the Proxy chain and authentication in Options->Connection

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .