Questions tagged [zap]

OWASP Zed Attack Proxy is a free and collaborative security tool. It is is devoted to the detection of vulnerabilities in web applications, for both beginners and professionals of application security

Filter by
Sorted by
Tagged with
5 votes
2 answers

Why are HTTPS requests blocked by Firefox when using ZAP proxy?

I have Zed Attack Proxy (ZAP) on my machine and my browser is Firefox. When I route the browser traffic through the ZAP proxy (using FoxyProxy), if it's HTTPS traffic, Firefox says "Your connection is ...
Jason Krs's user avatar
  • 369
0 votes
1 answer

Adding Payload to URL-based SQL Injection: Seeking Guidance and Best Practices

I recently performed a vulnerability assessment on a system using ZAP (Zed Attack Proxy) and received a finding indicating a likely SQL injection vulnerability. The query time is controllable using ...
Floppa's user avatar
  • 11
7 votes
1 answer

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
Krishna Pandey's user avatar
6 votes
2 answers

OWASP ZAP FUZZ functionality not highlighted

I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords. But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint ...
Manikya's user avatar
  • 61
4 votes
2 answers

False positive SQL Injection by ZAP with adding new parameter query

I have a spring MVC web application and am running ZAP Active scan on it. I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
Hima's user avatar
  • 41
2 votes
2 answers

How strict should I be in rejecting unexpected query parameters?

TL;DR Is it a "best practice" to return an HTTP 400 Bad Request response if extra parameters are sent with a request? I'm putting together a web app and doings some testing with OWASP ZAP. I'm pretty ...
Kryten's user avatar
  • 349