0

During scanning my https website via owasp zap , I found that username and password information is not encrypted. What could be the reason and how to fix. Please see below screenshot of ZAP.enter image description here

Improve this question
6
  • 3
    I'm not familiar with zap, so maybe I'm missing something. What seems to be the problem? As far as I can tell, the username and password are sent on an https:// connection, so they are encrypted.
    – Gilles 'SO- stop being evil'
    Commented Jul 25, 2019 at 6:56
  • Concern is that they are not encrypted. Is this SSL certificate issue?
    – Muhammad Ali Khamis
    Commented Jul 25, 2019 at 6:57
  • 1
    @MuhammadAliKhamis ZAP is a man-in-the-middle proxy, meaning that it sits in the middle of a normally-encrypted connection. The only reason it can do this is that you trusted its certificate on the client, which allows it to impersonate the server.
    – Gordon Davisson
    Commented Jul 25, 2019 at 7:04
  • @Gilles: The communication channel is encrypted, the credentials are transmitted over the encrypted communication channel in plain text.
    – Jeroen
    Commented Jul 25, 2019 at 8:42
  • @GordonDavisson how about chrome dev tools (inspect element). I can see there also.
    – Muhammad Ali Khamis
    Commented Jul 25, 2019 at 9:04

1 Answer 1

Reset to default
5

OWASP ZAP is like a MITM proxy very similar to Burp suite.Ofcourse it can read the https because you must have installed a Root CA certificate while setting it up.There is nothing wrong with your website in regards to your question

Improve this answer
2
  • I can see the information via chrome inspect. Is this still due to Root CA certificate?
    – Muhammad Ali Khamis
    Commented Jul 25, 2019 at 7:33
  • 6
    @MuhammadAliKhamis If you mean the browser dev tools, well, obviously you can; the browser does all the encryption (and decryption) so it knows both the plaintext and the ciphertext, and the dev tools would be quite useless if they showed ciphertext instead of plaintext.
    – CBHacking
    Commented Jul 25, 2019 at 8:12

Not the answer you're looking for? Browse other questions tagged .