2

I need some help with setting up OWASP ZAP to correctly crawl my One-page Angular website with the spider.

I successfully set up a zscript which will handle the login and add a HTTP Session I can set as active.

However my website has a special need to add an auth-token and auth-id to the header additionally to the JSESSION-ID. However the spider won't do it automatically, so I need help with configurating it correctly.

The header which works looks like this:

GET http://localhost:8180/rest/crud/jobDefinition HTTP/1.1
Host: localhost:8180
Proxy-Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json, text/plain, */*
auth-id: 1015
auth-token: 2b84722e-3270-483d-8852-e319b8c12810
Referer: http://localhost:8180/
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: JSESSIONID=7evOfQDs5F0bXcsmSq0rIM3U6AYQ1-PoD9L4HRb3.FG003.server01; pi_side_menu_size=large; authToken=2b84722e-3270-483d-8852-e319b8c12810

the only header content my spider in ZAP is sending is this:

GET http://localhost:8180/rest/permission/ HTTP/1.1
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0
Cookie: JSESSIONID=D1L17-8UQ4CpAeJ4NC40txHP3YPHWG8e6dyep-Js.FG003.server01
Host: localhost:8180

The script to login is loaded into my session context and when I start the spider it should either find my active marked session and use that one or perform the login over the script.

Checking forced user mode didn't change anything, also I cant find the configuration to let my spider to use these header variables.

Is it even possible or can I only use a passive scan?

2

Authenticated scans are tricky beasts. They do work, but can be tricky to set up. We have a FAQ which explains about form based auth: https://github.com/zaproxy/zaproxy/wiki/FAQformauth - its still relevant to other forms of auth, esp the trouble shooting section.

You can also inject headers directly using the Replacer add-on.

  • Thank you for your response. Could you assist me on how to define a Replacer which will use a variable that was found from a zest script or more over how to access parameters to assign in the Replacer? – Nico Feb 8 '18 at 12:33
  • I'd need more info about what you're doing - might be a better one of the ZAP User Group? groups.google.com/group/zaproxy-users – Simon Bennetts Feb 9 '18 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.