I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form fields on a page? I heard this can be done in OWASP-zap but cannot figure out how to do it. Can someone shed some light on this for me?

  • You can right-click on captured web requests and click "fuzz" (if I remember correctly)
    – Joe
    May 9 '18 at 19:59
  • But will that fuzz all form fields on that specific page? I go through all pages on the web app and inject javascript to see what I can exploit but dont want to keep dong this manually. May 9 '18 at 20:23
  • The form fields will probably make some http request, so you can edit the request to have just the parameters you need when fuzzing
    – Joe
    May 9 '18 at 20:30

With ZAP Fuzzing you can specify any number of locations to fuzz in a request.

However if you want to apply specific attacks and know what results you're looking for you might be better off with writing an active scan rule. We have various examples here: https://github.com/zaproxy/community-scripts/tree/master/active

  • Also, any good suggestions on owasp-zap tutorials and guides that I can check out? May 10 '18 at 13:41
  • Tutorials and videos take so long to produce :/ We do have some linked off github.com/zaproxy/zaproxy but we need more! May 11 '18 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.