OWASP ZAP: Add parameter to every request

Question

I am testing a website that makes heavily use of REST API endpoints. After authentication, the app adds the authentication token as part of every request in the form of:

OPTIONS
https://www.target.com/api/Action/some-action?data=foobar&access_token=THISISTHETOKEN
User-Agent: ...
Accept: */*
..
Host: target.com
Length: 0

How can I force that every request (inside the spider, scanner, etc.) uses this predefined parameter such that I can browser authenticated?

Update:

I tried creating a Http Sender Script but I fail at modifying the http url parameters:

function sendingRequest(msg, initiator, helper) {
    var token = org.parosproxy.paros.network.HtmlParameter
    token.setType(org.parosproxy.paros.network.HtmlParameter.Type.url)
    token.setName('access_token')
    token.setValue('foo')
    print('token: ' + String(token))
    msg.getUrlParams().add(token)
    print(msg.getUrlParams())
}

Answer 1

You can setup a Replacer rule or create an Http Sender script.

For a Replacer rule select the type as "Request Header String" then set the regex as something like (http://example.org.*) and the replacement something like $1?myParamToAdd=someValue (Note this replacer example is untested.)

For an HttpSender script something like the following should work:

var URL_TYPE    = org.parosproxy.paros.network.HtmlParameter.Type.url;
var HtmlParameter = Java.type('org.parosproxy.paros.network.HtmlParameter');

var paramName = 'myParamToAdd';
var paramValue = 'someValuetoAdd';

function sendingRequest(msg, initiator, helper) {
  if (!msg.getRequestHeader().getURI().toString().contains(paramName + '=' + paramValue)) {
    //You might want to add a check here for the proper domain or path as well..
    var urlParams = msg.getUrlParams();
    var newParam = new HtmlParameter(URL_TYPE, paramName, paramValue);
    urlParams.add(newParam); // you could print this if you need to see what's up
    msg.setGetParams(urlParams);
  }
  return msg;
}

function responseReceived(msg, initiator, helper) {
  //Nothing to do here
}

Answer 2

In the end the following HTTP Sender script worked for me:

var URL_TYPE   = org.parosproxy.paros.network.HtmlParameter.Type.url;
var authTokenName = 'access_token'
var authTokenValue = 'xrVNjdzmUomrpFcoyliUQYvfpgGPF5q8e2kCQNfhcs6pzO4yh22RACvSGNCeuMMg'

function sendingRequest(msg, initiator, helper) {
    var urlParams = msg.getUrlParams();
        // print ("Url Params before update: " + urlParams);
     var updatedUrlParams = modifyParams(urlParams);
     // print ("Url Params after update: " + updatedUrlParams);
     msg.setGetParams(updatedUrlParams);
}

function modifyParams(params) {
    var hasAccessToken = 0
    var iterator = params.iterator();
    while(iterator.hasNext()) {
        var param = iterator.next();
        // Check if the url parameters has the antiCsrfTokenName in it.
       //print('param:' + param.getName())
        if (param.getName().equals(authTokenName)) {
            var secureTokenValue = param.getValue();
          print('[i] auth:' + secureTokenValue)
            hasAccessToken = 1            
        }
    }
    if(hasAccessToken==0){
        print('[i] no token. Update query.')

        var HtmlParameter = Java.type('org.parosproxy.paros.network.HtmlParameter')
        var newParam = new HtmlParameter(URL_TYPE, authTokenName, authTokenValue);

        params.add(newParam) 
        print('[i] mod auth:' + params) 

    }

    return params;
}


function responseReceived(msg, initiator, helper) {
    // Debugging can be done using println like this
    //print('responseReceived called for url=' + msg.getRequestHeader().getURI().toString())
}