I have a target which is a Java applet. When I reach the IP in the browser and enter credentials into a form, a .jnlp file downloads, which I need to double-click on to access the page.
Does Zap have support for scanning this types of Web apps?
Many thanks.
-
The "page" is not served over the network, so a HTTP proxy is not the right tool for the job– schroeder ♦Feb 14, 2020 at 16:11
-
@schroeder With all due respect, I don't think this is correct. From fileinfo.com/extension/jnlp: "JNLP files are used for launching and managing Java programs over a network or on the web (e.g., an applet in a web browser)."– postoronnimFeb 14, 2020 at 16:14
-
Is the java app launched and served over the network, or is it downloaded locally and run on the local machine?– schroeder ♦Feb 14, 2020 at 16:23
-
@schroeder The app is run locally, but it makes calls over the network.– postoronnimFeb 14, 2020 at 16:32
-
So then any proxy is only going to be able to capture what is actually sent. And that's not likely to be HTTP, right?– schroeder ♦Feb 14, 2020 at 16:33
|
Show 1 more comment
1 Answer
Per: https://java.com/en/download/help/proxy_setup.xml For a Java Applet the proxy details can be set via the Java Control Panel.
Configure Proxies through the Java Control Panel
- In the Java Control Panel, under the General tab, click on Network Settings.
- Select the Use Browser Settings checkbox.
- Click OK to save your changes.
- Network Settings for the Java Control Panel
- Close all browser windows. Restart the browser and try to load the applet.
- If the applet still does not load and you see the same connection error, try to configure your web browser's proxy settings.
So yes you should be able to configure either Java or your Browser to use ZAP in order to capture and manipulate the traffic from a Java Applet.
