I need some help with setting up OWASP ZAP to correctly crawl my One-page Angular website with the spider.
I successfully set up a zscript which will handle the login and add a HTTP Session I can set as active.
However my website has a special need to add an auth-token
and auth-id
to the header additionally to the JSESSION-ID
. However the spider won't do it automatically, so I need help with configurating it correctly.
The header which works looks like this:
GET http://localhost:8180/rest/crud/jobDefinition HTTP/1.1
Host: localhost:8180
Proxy-Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json, text/plain, */*
auth-id: 1015
auth-token: 2b84722e-3270-483d-8852-e319b8c12810
Referer: http://localhost:8180/
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: JSESSIONID=7evOfQDs5F0bXcsmSq0rIM3U6AYQ1-PoD9L4HRb3.FG003.server01; pi_side_menu_size=large; authToken=2b84722e-3270-483d-8852-e319b8c12810
the only header content my spider in ZAP is sending is this:
GET http://localhost:8180/rest/permission/ HTTP/1.1
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
Cookie: JSESSIONID=D1L17-8UQ4CpAeJ4NC40txHP3YPHWG8e6dyep-Js.FG003.server01
Host: localhost:8180
The script to login is loaded into my session context and when I start the spider it should either find my active marked session and use that one or perform the login over the script.
Checking forced user mode didn't change anything, also I cant find the configuration to let my spider to use these header variables.
Is it even possible or can I only use a passive scan?