I need to build an automated tool that will be able to login to any website supporting basic auth to perform an authenticated scan with OWASP Zap (credentials provided). Here is what I have in mind: using python requests library, make an initial login request to the login page, parse the response, and based on it, create a login Zest script. Then use that to authenticate Zap for spidering and scanning. Are there are the potential pitfalls with this design, can it work in principle? Many thanks.


ZAP supports HTTP basic authentication natively, so you wont need to use Zest in this case. If you know that an app uses basic auth then you can set that up via the API. However I recommend that you start by using the ZAP desktop as this is much easier to use when debugging issues. For specific help with this its probably quicker to ask on the ZAP User Group: https://groups.google.com/group/zaproxy-users

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.