Questions tagged [zap]
OWASP Zed Attack Proxy is a free and collaborative security tool. It is is devoted to the detection of vulnerabilities in web applications, for both beginners and professionals of application security
6
questions
6
votes
2
answers
28k
views
Why are HTTPS requests blocked by Firefox when using ZAP proxy?
I have Zed Attack Proxy (ZAP) on my machine and my browser is Firefox. When I route the browser traffic through the ZAP proxy (using FoxyProxy), if it's HTTPS traffic, Firefox says "Your connection is ...
- 379
0
votes
1
answer
3k
views
Adding Payload to URL-based SQL Injection: Seeking Guidance and Best Practices
I recently performed a vulnerability assessment on a system using ZAP (Zed Attack Proxy) and received a finding indicating a likely SQL injection vulnerability.
The query time is controllable using ...
- 11
7
votes
1
answer
25k
views
How to supply HTTP Basic Authentication details in OWASP ZAP proxy?
I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
- 1,507
6
votes
2
answers
2k
views
OWASP ZAP FUZZ functionality not highlighted
I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords.
But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint ...
- 61
3
votes
2
answers
3k
views
False positive SQL Injection by ZAP with adding new parameter query
I have a spring MVC web application and am running ZAP Active scan on it.
I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
- 31
2
votes
2
answers
2k
views
How strict should I be in rejecting unexpected query parameters?
TL;DR Is it a "best practice" to return an HTTP 400 Bad Request response if extra parameters are sent with a request?
I'm putting together a web app and doings some testing with OWASP ZAP. I'm pretty ...
- 349