-1

Let's say I've edited a request and successfully found a XSS vulnerability. Now, I want to validate that in the browser.

However, since the payload was sent with POST, I can't just use "Open URL in browser" since it would not send that POST data and exploit the XSS.

I could write an HTML form that does that for me, but is there a way to do that directly from ZAP?

Improve this question
1
  • Please comment after you downvote.
    – Shmuel H.
    Mar 10, 2019 at 20:46

2 Answers 2

Reset to default
2

There is with the ZAP HUD, which is not yet in the main release but is in the weekly releases: https://github.com/zaproxy/zap-hud

The HUD runs in the browser so when you display a request you'll see an option to Resend in Browser :)

Improve this answer
1

Another option it to open the (GET) request in the browser, then resubmit it with break turned on. The GET request will be intercepted by ZAP and you can then change it to a POST with the relevant data.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .