0

During scanning my https website via owasp zap , I found that username and password information is not encrypted. What could be the reason and how to fix. Please see below screenshot of ZAP.enter image description here

6
  • 3
    I'm not familiar with zap, so maybe I'm missing something. What seems to be the problem? As far as I can tell, the username and password are sent on an https:// connection, so they are encrypted. Jul 25, 2019 at 6:56
  • Concern is that they are not encrypted. Is this SSL certificate issue? Jul 25, 2019 at 6:57
  • 1
    @MuhammadAliKhamis ZAP is a man-in-the-middle proxy, meaning that it sits in the middle of a normally-encrypted connection. The only reason it can do this is that you trusted its certificate on the client, which allows it to impersonate the server. Jul 25, 2019 at 7:04
  • @Gilles: The communication channel is encrypted, the credentials are transmitted over the encrypted communication channel in plain text.
    – Jeroen
    Jul 25, 2019 at 8:42
  • @GordonDavisson how about chrome dev tools (inspect element). I can see there also. Jul 25, 2019 at 9:04

1 Answer 1

5

OWASP ZAP is like a MITM proxy very similar to Burp suite.Ofcourse it can read the https because you must have installed a Root CA certificate while setting it up.There is nothing wrong with your website in regards to your question

2
  • I can see the information via chrome inspect. Is this still due to Root CA certificate? Jul 25, 2019 at 7:33
  • 6
    @MuhammadAliKhamis If you mean the browser dev tools, well, obviously you can; the browser does all the encryption (and decryption) so it knows both the plaintext and the ciphertext, and the dev tools would be quite useless if they showed ciphertext instead of plaintext.
    – CBHacking
    Jul 25, 2019 at 8:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.