3

I need some help with setting up OWASP ZAP to correctly crawl my One-page Angular website with the spider.

I successfully set up a zscript which will handle the login and add a HTTP Session I can set as active.

However my website has a special need to add an auth-token and auth-id to the header additionally to the JSESSION-ID. However the spider won't do it automatically, so I need help with configurating it correctly.

The header which works looks like this:

GET http://localhost:8180/rest/crud/jobDefinition HTTP/1.1
Host: localhost:8180
Proxy-Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json, text/plain, */*
auth-id: 1015
auth-token: 2b84722e-3270-483d-8852-e319b8c12810
Referer: http://localhost:8180/
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: JSESSIONID=7evOfQDs5F0bXcsmSq0rIM3U6AYQ1-PoD9L4HRb3.FG003.server01; pi_side_menu_size=large; authToken=2b84722e-3270-483d-8852-e319b8c12810

the only header content my spider in ZAP is sending is this:

GET http://localhost:8180/rest/permission/ HTTP/1.1
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
Cookie: JSESSIONID=D1L17-8UQ4CpAeJ4NC40txHP3YPHWG8e6dyep-Js.FG003.server01
Host: localhost:8180

The script to login is loaded into my session context and when I start the spider it should either find my active marked session and use that one or perform the login over the script.

Checking forced user mode didn't change anything, also I cant find the configuration to let my spider to use these header variables.

Is it even possible or can I only use a passive scan?

Improve this question

1 Answer 1

Reset to default
2

Authenticated scans are tricky beasts. They do work, but can be tricky to set up. We have a FAQ which explains about form based auth: https://github.com/zaproxy/zaproxy/wiki/FAQformauth - its still relevant to other forms of auth, esp the trouble shooting section.

You can also inject headers directly using the Replacer add-on.

Improve this answer
2
  • Thank you for your response. Could you assist me on how to define a Replacer which will use a variable that was found from a zest script or more over how to access parameters to assign in the Replacer?
    – Nico
    Feb 8, 2018 at 12:33
  • I'd need more info about what you're doing - might be a better one of the ZAP User Group? groups.google.com/group/zaproxy-users
    – Simon Bennetts
    Feb 9, 2018 at 12:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .