Questions tagged [zap]
OWASP Zed Attack Proxy is a free and collaborative security tool. It is is devoted to the detection of vulnerabilities in web applications, for both beginners and professionals of application security
18
questions with no upvoted or accepted answers
2
votes
0
answers
935
views
HTTP proxy for smart card based SSL
I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't ...
- 59
2
votes
0
answers
2k
views
ZAP and Tamper Data is not getting any POST requests
I just started learning the OWASP ZAP Proxy using Webgoat. I am running these on my Mac.
I have configured Zap to listen to my Firefox, but I'm only able to send HTTP GET requests, there are no POST ...
- 29
2
votes
0
answers
1k
views
How to check if "/run timeout /T 5" remote command execution worked on HTML page?
I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea ...
- 95
1
vote
0
answers
1k
views
Certificate warning with NoxPlayer and OWASP ZAP
I have tried to dip my toe into android hacking. I followed this helpful article on Medium.
I'm using NoxPlayer emulator and OWASP ZAP as proxy. I have rooted the device, imported certificate from ZAP,...
1
vote
0
answers
190
views
Remote file inclusion (RFI) found - vulnerability or false positive?
For educational purposes, I am pentesting an app server of mine. I am using ZAP and it reports a remote file inclusion vulnerability. I looked at it and think its a false positive but before I miss ...
- 443
1
vote
0
answers
135
views
OWASP ZAP bruteforce 3 parameters Request from 3 payloads (parallel)
How I can fuzz a request with 3 parameters (locations) and 3 payloads:
request1 => parameter1=payload1.1;
parameter2=payload2.1;
parameter3=payload3.1;
request2 => ...
1
vote
0
answers
710
views
OWASP ZAP : How to perform authentication when API endpoint only accepts raw XML?
I'm currently working at testing an Angular 6 application using OWASP ZAP. I really enjoy this tool, but like many of us, I struggle with the authentication part, and without it the whole tool turns ...
- 111
1
vote
0
answers
981
views
OWASP ZAP does not scan all urls in Jenkins
I have two set ups with ZAP and Selenium, local and on Jenkins.
Locally, I can start ZAP, run a Selenium process with ZAP as a proxy and then start the spider and then put ZAP in attack mode. This ...
- 109
1
vote
0
answers
635
views
Zed Attack Proxy Fuzzer cookie handling
I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
- 111
0
votes
1
answer
95
views
ZAP authenticated scan without locking out the test user
I'm trying to set up an authenticated scan for a webapp, lets say admin.example.com. The authentication is done by a different service login.example.com through a JSON AJAX call. After successful ...
0
votes
1
answer
1k
views
Adding Payload to URL-based SQL Injection: Seeking Guidance and Best Practices
I recently performed a vulnerability assessment on a system using ZAP (Zed Attack Proxy) and received a finding indicating a likely SQL injection vulnerability.
The query time is controllable using ...
- 11
0
votes
0
answers
3k
views
ZAP Error [java.net.ConnectException]: Connection refused (Connection refused)
I am trying to connect to http://challenge01.root-me.org/web-serveur/ch10/ in Firefox with FoxyProxy and OWASP ZAP and I got this error message
ZAP Error [java.net.ConnectException]: Connection ...
- 9
0
votes
1
answer
238
views
What is the best way for OWASP Zap to handle Unique Fields and API Sequences?
First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
- 11
0
votes
1
answer
2k
views
How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?
I have a web application with a log in page.
In the log in page, I've set maxlength for the username input and the password input, which looks like the code below.
@Html.TextBoxFor(m => m....
- 111
0
votes
1
answer
612
views
Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection
I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device.
I followed the setup instructions available here: https://security.secure.force.com/...
- 101
0
votes
1
answer
885
views
How to configure active scan input vectors in ZAP?
I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code:
private static final String ZAP_ADDRESS = "localhost";
private static ...
0
votes
1
answer
150
views
Benefit of Parameter Map size validation in web application controller
I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
- 41
-1
votes
1
answer
508
views
fuzzing xss mutillidae with OWASP ZAP
I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able ...
