Questions tagged [zap]

OWASP Zed Attack Proxy is a free and collaborative security tool. It is is devoted to the detection of vulnerabilities in web applications, for both beginners and professionals of application security

Filter by
Sorted by
Tagged with
0
votes
1answer
35 views

What is the best way for OWASP Zap to handle Unique Fields and API Sequences?

First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
0
votes
2answers
49 views

OWASP ZAP API HTTP Sessions setup

I'm trying to create a script using the Node ZAP SDK. The script needs to perform an active scan of the site on localhost while signed in as a super admin; if no user is signed in, it can only reach ...
0
votes
1answer
47 views

Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?

I have an iOS app with certificate pinning to two different servers. I want to test this certificate pinning with a MITM attack, so I did: Set proxy at my PC, in macos wifi settings -> advanced -> ...
1
vote
2answers
83 views

What is the best way to get OWASP ZAP to fuzz parameters with real data?

I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically ...
0
votes
1answer
56 views

Stop an in-progress passive scan in OWASP ZAP 2.9

I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all. I have disabled all ...
0
votes
2answers
82 views

OWASP ZAP: Add parameter to every request

I am testing a website that makes heavily use of REST API endpoints. After authentication, the app adds the authentication token as part of every request in the form of: OPTIONS https://www.target....
2
votes
1answer
84 views

Using this path traversal security issue

I used zap to scan one of my websites and found a path traversal issue. These are the informations: Attack: c:/ URL: www.example.com/example.php Parameter: mail I am now tinkering around in the ...
0
votes
1answer
43 views

Can Zap scan a web app launched as a JAVA applet?

I have a target which is a Java applet. When I reach the IP in the browser and enter credentials into a form, a .jnlp file downloads, which I need to double-click on to access the page. Does Zap have ...
5
votes
2answers
361 views

Are files like favicon.ico, robots.txt, and sitemap.xml vulnerable to XSS?

A Zap scan against an app detected the "Web Browser XSS Protection Not Enabled" vulnerability on sitemap and favicon. Would it be safe to ignore those URLs or does it mean that the app is vulnerable? ...
0
votes
1answer
122 views

How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below. @Html.TextBoxFor(m => m....
0
votes
1answer
109 views

OWASP ZAP submit forms

I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map: I ran Active scan, Spider and AJAX spider on the GET:sqli node. As ...
0
votes
0answers
54 views

Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection

I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device. I followed the setup instructions available here: https://security.secure.force.com/...
0
votes
1answer
156 views

Use OWASP ZAP import URLs addon programatically and change the HTTP method

I was thinking of using this functionality in my script, but it seems that importing URL file automatically sets GET method for every URL on the list, so when Active Scan is run, it only performs GET ...
3
votes
1answer
3k views

What are the differences between Burp and OWASP ZAP?

I am new to security testing and I'm confused about two web proxy tools, namely Burp and OWASP ZAP. Both seem to fulfill the same task, so what exactly are the differences between them?
0
votes
1answer
442 views

ZAP Proxy unable to launch browser invalid argument: can't kill an exited process

Using OWSAP ZAP 2.8.0 On Ubuntu 19.04 With openjdk version 11.0.3 installed When clicking the "Launch Browser" button on ZAP to launch the HUD enabled browser for ZAP, no browser is launched and an ...
0
votes
1answer
165 views

UserName and Password information can be seen on https [duplicate]

During scanning my https website via owasp zap , I found that username and password information is not encrypted. What could be the reason and how to fix. Please see below screenshot of ZAP.
0
votes
1answer
88 views

Implementing generic login for Zap

I need to build an automated tool that will be able to login to any website supporting basic auth to perform an authenticated scan with OWASP Zap (credentials provided). Here is what I have in mind: ...
0
votes
1answer
211 views

Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations

I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat. 1 Setup Local proxies in webgoat to run on localhost 8090 2 Exported the certificate and imported it in ...
1
vote
1answer
320 views

OWASP ZAP uses non-existent parameters

While running scans with ZAP, I noticed that many of the reported vulnerabilities involve sending malicious content as a value to a parameter named "query". For example: http://<url>:<port&...
1
vote
2answers
123 views

How strict should I be in rejecting unexpected query parameters?

TL;DR Is it a "best practice" to return an HTTP 400 Bad Request response if extra parameters are sent with a request? I'm putting together a web app and doings some testing with OWASP ZAP. I'm pretty ...
0
votes
3answers
620 views

Setting up OWASP ZAP Authentication against 2 page forms authenication

My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I ...
-1
votes
2answers
152 views

ZAP: Evaluate / Show response in browser

Let's say I've edited a request and successfully found a XSS vulnerability. Now, I want to validate that in the browser. However, since the payload was sent with POST, I can't just use "Open URL in ...
2
votes
2answers
674 views

Redirect OWASP ZAP IP:Port to localhost like in Burp

I want to intercept an application. It connects to an IP and port. I have to connect to localhost:443 to make it work (there's a gateway that routes depending on the port). In Burp I was able to set ...
0
votes
1answer
120 views

Adding a static token to ZAP vulnerability scanner

I am currently trying to get the OWASP ZAP scanners working on a peculiar website. When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter. ...
-1
votes
1answer
279 views

How to automate OWASP ZAP Fuzzing

Is there any way I can automate fuzzing in zap. I know how to do it manually. But is there any way to create test suite and execute?
2
votes
2answers
302 views

What is the importance of fuzzing?

I’ve heard a lot about fuzzing website parameters with programs like OWASP-zap but what is the importance of it? A simple active scan finds vulnerabilities in a website such as XSS. So why do we need ...
0
votes
1answer
1k views

How does OWASP ZAP find Reflected XSS?

What I'm doing: I'm using OWASP Zap to find vulnerabilities in a site (I have the owner's consent) and Zap came up with a Reflected XSS Vulnerability after I did an active scan on a POST request. It ...
-1
votes
1answer
224 views

fuzzing xss mutillidae with OWASP ZAP

I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able ...
1
vote
0answers
338 views

OWASP ZAP : How to perform authentication when API endpoint only accepts raw XML?

I'm currently working at testing an Angular 6 application using OWASP ZAP. I really enjoy this tool, but like many of us, I struggle with the authentication part, and without it the whole tool turns ...
1
vote
0answers
541 views

OWASP ZAP does not scan all urls in Jenkins

I have two set ups with ZAP and Selenium, local and on Jenkins. Locally, I can start ZAP, run a Selenium process with ZAP as a proxy and then start the spider and then put ZAP in attack mode. This ...
0
votes
1answer
524 views

How to configure active scan input vectors in ZAP?

I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code: private static final String ZAP_ADDRESS = "localhost"; private static ...
2
votes
1answer
552 views

Running Selenium Jenkins, through OWASP ZAP, before scanning

I suspect that what I am trying to do is something that has been done before. Hopefully, this is possible and someone knows how its done. Any information would be greatly appreciated. I am attempting ...
1
vote
1answer
1k views

Not able to see WebGoat requests in ZAP proxy

I have configured ZAP to port 8090 and also Firefox to 8090, but I am unable to see any requests from WebGoat lessons, whatsoever, except the initial request of http://detectportal.firefox.com. ...
0
votes
1answer
59 views

Benefit of Parameter Map size validation in web application controller

I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
1
vote
1answer
260 views

Cross Site Scripting on a Unique Key

Is it possible to perform a cross-site scripting attack by entering my script into a field that is required to match a specific value? I am scanning an application for vulnerabilities, and my ...
3
votes
1answer
134 views

Is there a way to find out what information website queries about us? [closed]

What tool or software should I look for to find out what "fingerprinting" data a website is tracking? Like, I want to know, if website looks for a cache and/or fonts installed in system, or Canval, ...
1
vote
1answer
2k views

OWASP ZAP: How to use TLS client certificate authentication?

Is there a way to get OWASP ZAP to send a client certificate? I have an HTTPS website that receives client certificates for authentication. I have the certificates installed in the browser. ...
3
votes
1answer
1k views

False positive SQL Injection by ZAP with adding new parameter query

I have a spring MVC web application and am running ZAP Active scan on it. I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
0
votes
1answer
2k views

What is the risk of private IP address disclosure if it is the user IP?

I am checking a web application with OWASP Zed Attack Proxy (ZAP). There is a vulnerability (low) that says "private IP address disclosure" and when I check for more details I found that it is my IP,...
0
votes
1answer
954 views

How to redirect any response to an arbitrary location in OWASP ZAP's request editor?

I am trying to find stored XSS in an application. Luckily, the application allows me to insert and edit the description of myself that is displayed to anyone visiting my profile. The location where ...
1
vote
1answer
1k views

Authenticating With OWASP ZAP Script

I am currently working on a python script that will automate zap for me so I do not have to go in and manually fuzz the fields or crawl pages. The part I am stuck on is that my script currently can ...
0
votes
1answer
254 views

Running Directory Traversal Against POST Request Headers [closed]

I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
0
votes
1answer
401 views

Integrate OData pentesting tool to ZAP add-on [closed]

We are currently working on a ZAP (Zed Attack Proxy) add-on designed to facilitate the pentesting of our new framework. Our solution is using OData so we were wondering if their was existing tools ...
0
votes
1answer
4k views

Fuzzing with Owasp-Zap

I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form ...
0
votes
1answer
431 views

OWASP ZAP: Infinite Redirect Loop infinitely appending a value to a cookie

I have a website that I need to scan with OWASP's ZAP tool 2.70. It previously worked as long as cookies were enabled. The site is a .net site proxied by Apache with mod_security. It works with all ...
1
vote
1answer
318 views

ZAP: Can't Execute Scripts within Zed Attack Proxy

I try to execute the community script "Extender/HTTP Message Logger.js". I first double click on the script to make it open in the scripting console. However, in the scripting console, the "Execute" ...
1
vote
1answer
939 views

Provide json post data in form based authentification

ZAP provides a way to turn a login (POST) request into a logging pattern (through the "mark as ..." in context menu). When the data is something like "user=toto&psswd=t@T°", it will translate it ...
1
vote
1answer
1k views

Does the OWASP Zed Attack Proxy project have a list of all the vulnerabilities it tries to find/exploit?

I'm trying to compile a list of vulnerabilities that ZAP tries to find when you run the "Active Scan" in ATTACK mode on a webapp. Does this list exist in the documentation anywhere? If it also has a ...
1
vote
1answer
538 views

How to configure ZAP for Desktop Appliation

I have used ZAP for performing MiTM for Web Applications, what are the settings or methods to perfrom MitM for a Desktop Application ? Is there a way you could setup ZAP as a system proxy so you can ...
1
vote
2answers
111 views

After a full web vulnerability scan, do we need to test each & every similar field for possible injections?

I ran a zap scan for my project and found some medium & low level vulnerabilities. But going through some posts, I found that we should run injections (sql, xss, command) on text fields also. But ...