0

I have a target which is a Java applet. When I reach the IP in the browser and enter credentials into a form, a .jnlp file downloads, which I need to double-click on to access the page. Does Zap have support for scanning this types of Web apps? Many thanks. enter image description here

6
  • The "page" is not served over the network, so a HTTP proxy is not the right tool for the job
    – schroeder
    Feb 14 '20 at 16:11
  • @schroeder With all due respect, I don't think this is correct. From fileinfo.com/extension/jnlp: "JNLP files are used for launching and managing Java programs over a network or on the web (e.g., an applet in a web browser)." Feb 14 '20 at 16:14
  • Is the java app launched and served over the network, or is it downloaded locally and run on the local machine?
    – schroeder
    Feb 14 '20 at 16:23
  • @schroeder The app is run locally, but it makes calls over the network. Feb 14 '20 at 16:32
  • So then any proxy is only going to be able to capture what is actually sent. And that's not likely to be HTTP, right?
    – schroeder
    Feb 14 '20 at 16:33
1

Per: https://java.com/en/download/help/proxy_setup.xml For a Java Applet the proxy details can be set via the Java Control Panel.

Configure Proxies through the Java Control Panel

  1. In the Java Control Panel, under the General tab, click on Network Settings.
  2. Select the Use Browser Settings checkbox.
  3. Click OK to save your changes.

enter image description here

  1. Network Settings for the Java Control Panel
  2. Close all browser windows. Restart the browser and try to load the applet.
  3. If the applet still does not load and you see the same connection error, try to configure your web browser's proxy settings.

So yes you should be able to configure either Java or your Browser to use ZAP in order to capture and manipulate the traffic from a Java Applet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.