Questions tagged [zap]

OWASP Zed Attack Proxy is a free and collaborative security tool. It is is devoted to the detection of vulnerabilities in web applications, for both beginners and professionals of application security

Filter by
Sorted by
Tagged with
0 votes
1 answer
79 views

Brute force alphanumeric passwords between 1 to 7 characters long with ZAP

In BurpSuite, you can brute force a password of any length and any character set (in my case, alphanumeric passwords between 1 to 7 characters long). How does one do it in OWASP ZAP, without actually ...
user avatar
0 votes
1 answer
135 views

How to test an Angular SPA for DOM XSS with OWASP ZAP?

I want to test an Angular SPA for any DOM-based XSS. How do I do that with OWASP ZAP?
user avatar
0 votes
1 answer
208 views

How to include OWASP Zap in CI/CD

Company wants to start improving security. Test team uses OWASP Zap tool (GUI version) to scan the new version for vulnerabilities. That usually takes between half an hour to 90 minutes. How to ...
user avatar
0 votes
1 answer
75 views

How to add nested Data Driven nodes in ZAP

I wish to map a site with owasp zaproxy. The site uses data driven nodes in the URL in such a format to download image data for maps: https://subdomain.domain.tld/maps/<<region>>/<<...
user avatar
  • 422
0 votes
1 answer
172 views

Capturing data from a Change Password form

Through ZAP, I was able to capture the following from a Change Password form: GET /rest/user/change-password?current=P@ssword&new=password123 &repeat=password123 HTTP/1.1 Host: localhost:3000 ...
user avatar
  • 39
0 votes
1 answer
257 views

How can i fuzz two values in ZAP with the same payload?

In ZAP (Zed Attack Proxy) its possible to fuzz requests. I have two values cookieUserId and cookieUser. They both have the same value and i want to change the ID for both fuzzing location. If i add a ...
user avatar
  • 21
1 vote
1 answer
116 views

Fuzzing in OWASP ZAP through the command line

First of all, I'm running ZAP in a Docker container and will automate ZAP scans using Jenkins. The official docker image seems to have a script that performs spidering and active scans but does not do ...
user avatar
  • 11
0 votes
1 answer
125 views

Owasp Zap: False positives in the PiiScan

I work a lot with OWASP Zap, and I am very satisfied. Nevertheless, I have the problem with all my scans that I always have false positives in the PiiScan area. Among other things, Googlemaps numbers, ...
user avatar
  • 131
0 votes
1 answer
125 views

Zap API: endpoints unavailable

I am running Zap version 2.10.0 and was hoping to gain more control of logins with users.authenticate_as_user, link It is, however, unavailable as when I list attributes of a users object in python I ...
user avatar
1 vote
0 answers
732 views

Certificate warning with NoxPlayer and OWASP ZAP

I have tried to dip my toe into android hacking. I followed this helpful article on Medium. I'm using NoxPlayer emulator and OWASP ZAP as proxy. I have rooted the device, imported certificate from ZAP,...
user avatar
0 votes
1 answer
575 views

Remote OS Command Injection - scanned by ZAP

A web scan by ZAP indicated that my website is vulnerable to a Remote OS command injection. Details are below: This is the URL the scanner found vulnerable: https://[redacted]/[redacted]?address=ZAP%...
user avatar
  • 103
1 vote
0 answers
112 views

Remote file inclusion (RFI) found - vulnerability or false positive?

For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
user avatar
  • 413
2 votes
1 answer
503 views

Detailed explanations on OWASP Zap Security scan rules

As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
user avatar
1 vote
1 answer
563 views

Auto-login to refresh token in Burp Suite 2

I want to run an automatic scan on a web application made with Angular and JSNode. On this one I have access to different types of accounts. On ZAP OWASP I can select the POST request, it detects the ...
user avatar
  • 13
1 vote
0 answers
108 views

OWASP ZAP bruteforce 3 parameters Request from 3 payloads (parallel)

How I can fuzz a request with 3 parameters (locations) and 3 payloads: request1 => parameter1=payload1.1; parameter2=payload2.1; parameter3=payload3.1; request2 => ...
user avatar
1 vote
0 answers
2k views

ZAP Error [java.net.ConnectException]: Connection refused (Connection refused)

I am trying to connect to http://challenge01.root-me.org/web-serveur/ch10/ in Firefox with FoxyProxy and OWASP ZAP and I got this error message ZAP Error [java.net.ConnectException]: Connection ...
user avatar
0 votes
2 answers
209 views

Is it possible to see the history of SSL handshakes going out of OWASP ZAP proxy?

Let's say I perform some request through OWASP ZAP local proxy, and it fails SSL handshake for some reason. Is there any way to see what SSL certificates zaproxy offered during the handshake, at ...
user avatar
5 votes
3 answers
271 views

Is non-executed content still considered XSS?

I'm working through an OWASP Zap report that has flagged several URLs on the domain as being vulnerable to XSS, but the vulnerability is never output in a context that is executable by the browser. ...
user avatar
  • 151
0 votes
1 answer
179 views

What is the best way for OWASP Zap to handle Unique Fields and API Sequences?

First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
user avatar
0 votes
2 answers
823 views

OWASP ZAP API HTTP Sessions setup

I'm trying to create a script using the Node ZAP SDK. The script needs to perform an active scan of the site on localhost while signed in as a super admin; if no user is signed in, it can only reach ...
user avatar
  • 113
0 votes
1 answer
626 views

Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?

I have an iOS app with certificate pinning to two different servers. I want to test this certificate pinning with a MITM attack, so I did: Set proxy at my PC, in macos wifi settings -> advanced -> ...
user avatar
1 vote
2 answers
1k views

What is the best way to get OWASP ZAP to fuzz parameters with real data?

I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically ...
user avatar
0 votes
1 answer
1k views

Stop an in-progress passive scan in OWASP ZAP 2.9

I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all. I have disabled all ...
user avatar
0 votes
2 answers
1k views

OWASP ZAP: Add parameter to every request

I am testing a website that makes heavily use of REST API endpoints. After authentication, the app adds the authentication token as part of every request in the form of: OPTIONS https://www.target....
user avatar
2 votes
1 answer
516 views

Using this path traversal security issue

I used zap to scan one of my websites and found a path traversal issue. These are the informations: Attack: c:/ URL: www.example.com/example.php Parameter: mail I am now tinkering around in the ...
user avatar
  • 157
0 votes
1 answer
96 views

Can Zap scan a web app launched as a JAVA applet?

I have a target which is a Java applet. When I reach the IP in the browser and enter credentials into a form, a .jnlp file downloads, which I need to double-click on to access the page. Does Zap have ...
user avatar
5 votes
2 answers
1k views

Are files like favicon.ico, robots.txt, and sitemap.xml vulnerable to XSS?

A Zap scan against an app detected the "Web Browser XSS Protection Not Enabled" vulnerability on sitemap and favicon. Would it be safe to ignore those URLs or does it mean that the app is vulnerable? ...
user avatar
0 votes
1 answer
1k views

How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below. @Html.TextBoxFor(m => m....
user avatar
  • 111
0 votes
1 answer
553 views

OWASP ZAP submit forms

I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map: I ran Active scan, Spider and AJAX spider on the GET:sqli node. As ...
user avatar
0 votes
0 answers
371 views

Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection

I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device. I followed the setup instructions available here: https://security.secure.force.com/...
user avatar
  • 101
0 votes
1 answer
808 views

Use OWASP ZAP import URLs addon programatically and change the HTTP method

I was thinking of using this functionality in my script, but it seems that importing URL file automatically sets GET method for every URL on the list, so when Active Scan is run, it only performs GET ...
user avatar
14 votes
2 answers
13k views

What are the differences between Burp and OWASP ZAP?

I am new to security testing and I'm confused about two web proxy tools, namely Burp and OWASP ZAP. Both seem to fulfill the same task, so what exactly are the differences between them?
user avatar
1 vote
2 answers
1k views

ZAP Proxy unable to launch browser invalid argument: can't kill an exited process

Using OWSAP ZAP 2.8.0 On Ubuntu 19.04 With openjdk version 11.0.3 installed When clicking the "Launch Browser" button on ZAP to launch the HUD enabled browser for ZAP, no browser is launched and an ...
user avatar
0 votes
1 answer
454 views

UserName and Password information can be seen on https [duplicate]

During scanning my https website via owasp zap , I found that username and password information is not encrypted. What could be the reason and how to fix. Please see below screenshot of ZAP.
user avatar
0 votes
1 answer
193 views

Implementing generic login for Zap

I need to build an automated tool that will be able to login to any website supporting basic auth to perform an authenticated scan with OWASP Zap (credentials provided). Here is what I have in mind: ...
user avatar
0 votes
1 answer
612 views

Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations

I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat. 1 Setup Local proxies in webgoat to run on localhost 8090 2 Exported the certificate and imported it in ...
user avatar
1 vote
1 answer
571 views

OWASP ZAP uses non-existent parameters

While running scans with ZAP, I noticed that many of the reported vulnerabilities involve sending malicious content as a value to a parameter named "query". For example: http://<url>:<port&...
user avatar
  • 109
2 votes
2 answers
761 views

How strict should I be in rejecting unexpected query parameters?

TL;DR Is it a "best practice" to return an HTTP 400 Bad Request response if extra parameters are sent with a request? I'm putting together a web app and doings some testing with OWASP ZAP. I'm pretty ...
user avatar
  • 349
0 votes
3 answers
1k views

Setting up OWASP ZAP Authentication against 2 page forms authenication

My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I ...
user avatar
  • 101
-1 votes
2 answers
432 views

ZAP: Evaluate / Show response in browser

Let's say I've edited a request and successfully found a XSS vulnerability. Now, I want to validate that in the browser. However, since the payload was sent with POST, I can't just use "Open URL in ...
user avatar
  • 101
2 votes
2 answers
1k views

Redirect OWASP ZAP IP:Port to localhost like in Burp

I want to intercept an application. It connects to an IP and port. I have to connect to localhost:443 to make it work (there's a gateway that routes depending on the port). In Burp I was able to set ...
user avatar
1 vote
1 answer
250 views

Adding a static token to ZAP vulnerability scanner

I am currently trying to get the OWASP ZAP scanners working on a peculiar website. When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter. ...
user avatar
  • 11
-1 votes
1 answer
514 views

How to automate OWASP ZAP Fuzzing

Is there any way I can automate fuzzing in zap. I know how to do it manually. But is there any way to create test suite and execute?
user avatar
2 votes
2 answers
434 views

What is the importance of fuzzing?

I’ve heard a lot about fuzzing website parameters with programs like OWASP-zap but what is the importance of it? A simple active scan finds vulnerabilities in a website such as XSS. So why do we need ...
user avatar
  • 126
0 votes
1 answer
4k views

How does OWASP ZAP find Reflected XSS?

What I'm doing: I'm using OWASP Zap to find vulnerabilities in a site (I have the owner's consent) and Zap came up with a Reflected XSS Vulnerability after I did an active scan on a POST request. It ...
user avatar
  • 126
-1 votes
1 answer
421 views

fuzzing xss mutillidae with OWASP ZAP

I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able ...
user avatar
1 vote
0 answers
559 views

OWASP ZAP : How to perform authentication when API endpoint only accepts raw XML?

I'm currently working at testing an Angular 6 application using OWASP ZAP. I really enjoy this tool, but like many of us, I struggle with the authentication part, and without it the whole tool turns ...
user avatar
  • 111
1 vote
0 answers
819 views

OWASP ZAP does not scan all urls in Jenkins

I have two set ups with ZAP and Selenium, local and on Jenkins. Locally, I can start ZAP, run a Selenium process with ZAP as a proxy and then start the spider and then put ZAP in attack mode. This ...
user avatar
  • 109
1 vote
1 answer
800 views

How to configure active scan input vectors in ZAP?

I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code: private static final String ZAP_ADDRESS = "localhost"; private static ...
user avatar
2 votes
1 answer
808 views

Running Selenium Jenkins, through OWASP ZAP, before scanning

I suspect that what I am trying to do is something that has been done before. Hopefully, this is possible and someone knows how its done. Any information would be greatly appreciated. I am attempting ...
user avatar
  • 109