Questions tagged [zap]
OWASP Zed Attack Proxy is a free and collaborative security tool. It is is devoted to the detection of vulnerabilities in web applications, for both beginners and professionals of application security
104
questions
1
vote
1
answer
72
views
Automate ASVS with ZAP
I am new to this role. So I am trying to understand a few things.
My organisation wants to evaluate the existing application according to ASVS https://github.com/OWASP/ASVS/blob/master/4.0/docs_en/...
- 121
0
votes
2
answers
134
views
Which tool to use to automate REST API pentest
I want to run an automated REST API pentest, and I want to integrate my test into CI/CD pipeline. Note: I have the openapi specification of the APIs that I want to test.
My automated test will be ...
- 97
0
votes
1
answer
191
views
ZAP - Remote command injection found in API but real URL not shown anywhere, in scan returns 200 but manual test returns expected 400
Using ZAP OWASP 2.13.0 and found a so-called "Remote command injection". But either in report or in Alerts the URL + query the URL does not contain attack string. Open the query in Request ...
- 103
1
vote
1
answer
222
views
ZAP authenticated scan without locking out the test user
I'm trying to set up an authenticated scan for a webapp, lets say admin.example.com. The authentication is done by a different service login.example.com through a JSON AJAX call. After successful ...
0
votes
1
answer
394
views
Why use OWASP ZAP when it could damage the web application?
OWASP ZAP is used to scan vulnerability on web application but its site says " Because this is a simulation that acts like a real attack, actual damage can be done to a site’s functionality, data,...
- 3
0
votes
0
answers
40
views
Any idea why the param being modifed was removed from the HTML output in ZAP? [duplicate]
http://xxx/?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp%3A%2F%2Finput=%27+AND+4571%3D9588+AND+%27kISD%27%3D%27kISD
(Advanced SQL Injection)
here is the ZAP description:
The page results were ...
- 11
0
votes
1
answer
3k
views
Adding Payload to URL-based SQL Injection: Seeking Guidance and Best Practices
I recently performed a vulnerability assessment on a system using ZAP (Zed Attack Proxy) and received a finding indicating a likely SQL injection vulnerability.
The query time is controllable using ...
- 11
0
votes
1
answer
344
views
ZAP HUD is different
Started to get to grips with the OWASP ZAP tool, and can't solve the problem related to the ZAP HUD.
Why does the ZAP HUD frames (on the left- and right-hand sides of page) on some sites (like Github) ...
0
votes
1
answer
69
views
Cannot run ZapProxy add_header_request.py - throwable exception
I am dropping this
https://github.com/zaproxy/community-scripts/blob/main/httpsender/add_header_request.py into ZAP scripts window > Proxy
When I save and browse a site, I see java.lang.reflect....
- 3
0
votes
1
answer
495
views
Zap: How to export Fuzzer results/report with the Request and Response?
I'm relatively new to using OWASP ZAP. I tried fuzzing POST requests with Zap and am able to see all the messages sent in the Fuzzer tab.
When I select one of the messages in the Fuzzer tab, I can see ...
- 103
0
votes
1
answer
2k
views
Brute force alphanumeric passwords between 1 to 7 characters long with ZAP
In BurpSuite, you can brute force a password of any length and any character set (in my case, alphanumeric passwords between 1 to 7 characters long). How does one do it in OWASP ZAP, without actually ...
- 3
0
votes
1
answer
1k
views
How to test an Angular SPA for DOM XSS with OWASP ZAP?
I want to test an Angular SPA for any DOM-based XSS. How do I do that with OWASP ZAP?
- 31
1
vote
1
answer
2k
views
How to include OWASP Zap in CI/CD
Company wants to start improving security. Test team uses OWASP Zap tool (GUI version) to scan the new version for vulnerabilities. That usually takes between half an hour to 90 minutes.
How to ...
- 113
0
votes
1
answer
231
views
How to add nested Data Driven nodes in ZAP
I wish to map a site with owasp zaproxy. The site uses data driven nodes in the URL in such a format to download image data for maps:
https://subdomain.domain.tld/maps/<<region>>/<<...
- 392
0
votes
1
answer
258
views
Capturing data from a Change Password form
Through ZAP, I was able to capture the following from a Change Password form:
GET /rest/user/change-password?current=P@ssword&new=password123
&repeat=password123 HTTP/1.1
Host: localhost:3000
...
- 49
0
votes
1
answer
1k
views
How can i fuzz two values in ZAP with the same payload?
In ZAP (Zed Attack Proxy) its possible to fuzz requests. I have two values cookieUserId and cookieUser. They both have the same value and i want to change the ID for both fuzzing location. If i add a ...
- 21
1
vote
1
answer
474
views
Fuzzing in OWASP ZAP through the command line
First of all, I'm running ZAP in a Docker container and will automate ZAP scans using Jenkins.
The official docker image seems to have a script that performs spidering and active scans but does not do ...
- 11
0
votes
1
answer
483
views
Owasp Zap: False positives in the PiiScan
I work a lot with OWASP Zap, and I am very satisfied. Nevertheless, I have the problem with all my scans that I always have false positives in the PiiScan area. Among other things, Googlemaps numbers, ...
- 131
0
votes
1
answer
176
views
Zap API: endpoints unavailable
I am running Zap version 2.10.0 and was hoping to gain more control of logins with users.authenticate_as_user, link
It is, however, unavailable as when I list attributes of a users object in python I ...
- 456
1
vote
0
answers
1k
views
Certificate warning with NoxPlayer and OWASP ZAP
I have tried to dip my toe into android hacking. I followed this helpful article on Medium.
I'm using NoxPlayer emulator and OWASP ZAP as proxy. I have rooted the device, imported certificate from ZAP,...
1
vote
1
answer
1k
views
Remote OS Command Injection - scanned by ZAP
A web scan by ZAP indicated that my website is vulnerable to a Remote OS command injection. Details are below:
This is the URL the scanner found vulnerable:
https://[redacted]/[redacted]?address=ZAP%...
- 123
1
vote
0
answers
251
views
Remote file inclusion (RFI) found - vulnerability or false positive?
For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
- 433
2
votes
1
answer
905
views
Detailed explanations on OWASP Zap Security scan rules
As an example, I have installed Anti-CSRF Scanning rule in ZAP proxy and scanned a POST request which does not verify the CSRF token value from the back end. Ideally, it is a CSRF vulnerability, but ...
- 31
1
vote
2
answers
1k
views
Auto-login to refresh token in Burp Suite 2
I want to run an automatic scan on a web application made with Angular and JSNode. On this one I have access to different types of accounts. On ZAP OWASP I can select the POST request, it detects the ...
- 13
1
vote
0
answers
176
views
OWASP ZAP bruteforce 3 parameters Request from 3 payloads (parallel)
How I can fuzz a request with 3 parameters (locations) and 3 payloads:
request1 => parameter1=payload1.1;
parameter2=payload2.1;
parameter3=payload3.1;
request2 => ...
0
votes
0
answers
3k
views
ZAP Error [java.net.ConnectException]: Connection refused (Connection refused)
I am trying to connect to http://challenge01.root-me.org/web-serveur/ch10/ in Firefox with FoxyProxy and OWASP ZAP and I got this error message
ZAP Error [java.net.ConnectException]: Connection ...
- 9
0
votes
2
answers
351
views
Is it possible to see the history of SSL handshakes going out of OWASP ZAP proxy?
Let's say I perform some request through OWASP ZAP local proxy, and it fails SSL handshake for some reason.
Is there any way to see what SSL certificates zaproxy offered during the handshake, at ...
- 103
5
votes
3
answers
537
views
Is non-executed content still considered XSS?
I'm working through an OWASP Zap report that has flagged several URLs on the domain as being vulnerable to XSS, but the vulnerability is never output in a context that is executable by the browser. ...
- 151
0
votes
1
answer
281
views
What is the best way for OWASP Zap to handle Unique Fields and API Sequences?
First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
- 11
0
votes
2
answers
1k
views
OWASP ZAP API HTTP Sessions setup
I'm trying to create a script using the Node ZAP SDK. The script needs to perform an active scan of the site on localhost while signed in as a super admin; if no user is signed in, it can only reach ...
- 113
0
votes
1
answer
1k
views
Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?
I have an iOS app with certificate pinning to two different servers.
I want to test this certificate pinning with a MITM attack, so I did:
Set proxy at my PC, in macos wifi settings -> advanced -> ...
- 103
1
vote
2
answers
2k
views
What is the best way to get OWASP ZAP to fuzz parameters with real data?
I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically ...
- 11
0
votes
1
answer
2k
views
Stop an in-progress passive scan in OWASP ZAP 2.9
I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all.
I have disabled all ...
0
votes
2
answers
3k
views
OWASP ZAP: Add parameter to every request
I am testing a website that makes heavily use of REST API endpoints. After authentication, the app adds the authentication token as part of every request in the form of:
OPTIONS
https://www.target....
- 283
2
votes
1
answer
757
views
Using this path traversal security issue
I used zap to scan one of my websites and found a path traversal issue.
These are the informations:
Attack: c:/
URL: www.example.com/example.php
Parameter: mail
I am now tinkering around in the ...
- 157
0
votes
1
answer
267
views
Can Zap scan a web app launched as a JAVA applet?
I have a target which is a Java applet. When I reach the IP in the browser and enter credentials into a form, a .jnlp file downloads, which I need to double-click on to access the page.
Does Zap have ...
- 456
5
votes
2
answers
2k
views
Are files like favicon.ico, robots.txt, and sitemap.xml vulnerable to XSS?
A Zap scan against an app detected the "Web Browser XSS Protection Not Enabled" vulnerability on sitemap and favicon. Would it be safe to ignore those URLs or does it mean that the app is vulnerable?
...
- 456
1
vote
1
answer
2k
views
How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?
I have a web application with a log in page.
In the log in page, I've set maxlength for the username input and the password input, which looks like the code below.
@Html.TextBoxFor(m => m....
- 121
0
votes
1
answer
926
views
OWASP ZAP submit forms
I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map:
I ran Active scan, Spider and AJAX spider on the GET:sqli node. As ...
- 101
0
votes
0
answers
773
views
Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection
I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device.
I followed the setup instructions available here: https://security.secure.force.com/...
- 101
0
votes
1
answer
1k
views
Use OWASP ZAP import URLs addon programatically and change the HTTP method
I was thinking of using this functionality in my script, but it seems that importing URL file automatically sets GET method for every URL on the list, so when Active Scan is run, it only performs GET ...
14
votes
2
answers
16k
views
What are the differences between Burp and OWASP ZAP?
I am new to security testing and I'm confused about two web proxy tools, namely Burp and OWASP ZAP.
Both seem to fulfill the same task, so what exactly are the differences between them?
- 329
1
vote
2
answers
2k
views
ZAP Proxy unable to launch browser invalid argument: can't kill an exited process
Using OWSAP ZAP 2.8.0
On Ubuntu 19.04
With openjdk version 11.0.3 installed
When clicking the "Launch Browser" button on ZAP to launch the HUD enabled browser for ZAP, no browser is launched and an ...
- 111
0
votes
1
answer
644
views
UserName and Password information can be seen on https [duplicate]
During scanning my https website via owasp zap , I found that username and password information is not encrypted. What could be the reason and how to fix. Please see below screenshot of ZAP.
0
votes
1
answer
280
views
Implementing generic login for Zap
I need to build an automated tool that will be able to login to any website supporting basic auth to perform an authenticated scan with OWASP Zap (credentials provided). Here is what I have in mind: ...
- 456
0
votes
1
answer
952
views
Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations
I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat.
1 Setup Local proxies in webgoat to run on localhost 8090
2 Exported the certificate and imported it in ...
0
votes
1
answer
863
views
OWASP ZAP uses non-existent parameters
While running scans with ZAP, I noticed that many of the reported vulnerabilities involve sending malicious content as a value to a parameter named "query". For example:
http://<url>:<port&...
- 99
2
votes
2
answers
2k
views
How strict should I be in rejecting unexpected query parameters?
TL;DR Is it a "best practice" to return an HTTP 400 Bad Request response if extra parameters are sent with a request?
I'm putting together a web app and doings some testing with OWASP ZAP. I'm pretty ...
- 349
1
vote
3
answers
2k
views
Setting up OWASP ZAP Authentication against 2 page forms authenication
My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I ...
- 111
-1
votes
2
answers
796
views
ZAP: Evaluate / Show response in browser
Let's say I've edited a request and successfully found a XSS vulnerability. Now, I want to validate that in the browser.
However, since the payload was sent with POST, I can't just use "Open URL in ...
- 101