0

While running scans with ZAP, I noticed that many of the reported vulnerabilities involve sending malicious content as a value to a parameter named "query". For example:

http://<url>:<port>/path/path/path?query=query+AND+1%3D1+--+

The api method in question, however, does not have a parameter that goes by this name, so I was wondering how the tool could possibly detect a vulnerability with this. ZAP did, in fact, report an SQL Injection vulnerability with "Medium" confidence from using a url like the above, and has had similar results with path traversal and xss.

Could this be a consequence of me not setting up ZAP correctly? Is it possible to for an api to be made to read parameters that the developers did not define? Is ZAP just guessing at the parameters the api uses?

Improve this question
17
  • How literal is your example? Did it also report a path/ path parameter?
    – schroeder ♦
    Commented May 28, 2019 at 18:09
  • URIs are just strings. Any parameter name can be supplied. I'm guessing there is/are frameworks (probably PHP) that have some vulnerability where the internal value of a DB query can be modified by a parameter.
    – JimmyJames
    Commented May 28, 2019 at 18:10
  • Is there anything in the logs that says what suite of tests is running this? There are 10 or so listed here: owasp.org/index.php/…
    – JimmyJames
    Commented May 28, 2019 at 18:16
  • The "path" is not literal". The literal parts are before "<url>" and after "?"
    – harrys
    Commented May 28, 2019 at 18:37
  • Looking for the logs (nothing immediately available in the zap directory). The link provided, however, seems to refer to 10 separate tools, however, rather than 10 different suites that can be used with this tool.
    – harrys
    Commented May 28, 2019 at 18:47

1 Answer 1

Reset to default
3

Yes, its added by this code: https://github.com/zaproxy/zaproxy/blob/develop/zap/src/main/java/org/parosproxy/paros/core/scanner/VariantAbstractQuery.java#L148-L153

This is added to see how webapps react to queries - if they handle them badly then yes this can introduce vulnerabilities.

If you think ZAP has reported false positives then please report them too us: https://github.com/zaproxy/zaproxy/issues/new?labels=bug&template=Bug_report.md

Note: As of ZAP 2.8 the addition of parameters to requests that didn't originally have them is now optional (and default off). Ref: https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsAscaninput#add-url-query-parameter

Improve this answer
4
  • OK. Thank you. It looks like my post is duplicated by another (I should've checked more carefully): security.stackexchange.com/questions/191758/…. So, I'll look at that. It looks like it might be a false positive, so I'll mention it on the board just in case.
    – harrys
    Commented May 29, 2019 at 14:43
  • The following request was reported as an SQL Injection vulnerability: GET http://<host>:<port>/<path>?query=query+AND+1%3D1+--+ HTTP/1.1 I inserted it into my browser and then inserted this: GET http://<host>:<port>/<path> HTTP/1.1 I found that the content for both requests were identical. This appears to contradict what was reported by ZAP: “The vulnerability was detected by successfully retrieving more data than originally returned, by manipulating the parameter”.
    – harrys
    Commented May 29, 2019 at 14:45
  • It looks like a similar issue has been reported already and a new version released since then: github.com/zaproxy/zaproxy/issues/4231. I'll check my version, update if necessary and rescan.
    – harrys
    Commented May 29, 2019 at 15:09
  • The addition of parameters was made optional last fall, it will be available in 2.8. mobile.twitter.com/kingthorin_rm/status/1041855009263108097
    – kingthorin
    Commented May 31, 2019 at 9:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .