Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically replace those parameters and body requests with real data? If not, what other optimum solutions are there solve this?
Thanks in advance!
The best option is to proxy requests that use real data through ZAP. These could be unit tests or something as simple as command line calls to curl. You can also make calls to the target system using the ZAP API.
The Form Handler add-on also allows you to specify values for individual fields, but I dont think this handles URL parameters.
I am guessing you are referring to the Active Scanner feature of Zap. The active scanner first looks at the discovered site nodes on the left side panel. So before running the active scan, you first want to populate those site nodes. You can do this with the spider, forced browsing (i.e. dirbuster), or manual browsing with the proxy. Then, once those nodes are populated you want to manually review them and adjust them if necessary.
From https://www.zaproxy.org/docs/desktop/start/features/structmods/ : — “The Sites tab show ZAP's representation of the application. If it is not a good representation of the structure then ZAP will not be able to attack the application effectively. There are currently 2 types of Structural Modifiers: * Data Driven Content which identify URL paths that represent data * Structural Parameters which identify parameters that represent application structure instead of user data” —
To adjust the structure of the Sites tab in order to Zap to attack it efficiently you must define contexts around the nodes, to group them or split them. Grouping the data driven ones is explained here: https://www.zaproxy.org/docs/desktop/start/features/ddc/ Splitting the structural ones is explained here: https://www.zaproxy.org/docs/desktop/start/features/structparams/
Then, once the Sites tab is structured in a logical way, you can begin your attack. My understanding is that in the Sites tab, the nodes defined as structural will be treated as such, so will be using the “real” key,value pairs defined by the site, whereas the nodes flagged as data will be treated as payload input vectors. The Active Scan might still try tampering with the structured parameters to look for certain vulnerabilities, but most of the tampering should be on the data parameters I believe.
Also, with the Zap Fuzzer feature, you can control which locations are fuzzed, such as a particular parameter you want to tamper with. Read more about that here: https://www.zaproxy.org/docs/desktop/addons/fuzzer/
You might also be interested in the FuzzDB Files addon: https://www.zaproxy.org/docs/desktop/addons/fuzzdb-files/
This guide is also worth checking out: https://medium.com/volosoft/running-penetration-tests-for-your-website-as-a-simple-developer-with-owasp-zap-493d6a7e182b
Hope I answered your question, or at least pointed you in the right direction.
