Questions tagged [zap]
OWASP Zed Attack Proxy is a free and collaborative security tool. It is is devoted to the detection of vulnerabilities in web applications, for both beginners and professionals of application security
102
questions
-1
votes
1
answer
606
views
How to automate OWASP ZAP Fuzzing
Is there any way I can automate fuzzing in zap. I know how to do it manually. But is there any way to create test suite and execute?
2
votes
2
answers
449
views
What is the importance of fuzzing?
I’ve heard a lot about fuzzing website parameters with programs like OWASP-zap but what is the importance of it? A simple active scan finds vulnerabilities in a website such as XSS. So why do we need ...
- 136
1
vote
1
answer
5k
views
How does OWASP ZAP find Reflected XSS?
What I'm doing:
I'm using OWASP Zap to find vulnerabilities in a site (I have the owner's consent) and Zap came up with a Reflected XSS Vulnerability after I did an active scan on a POST request. It ...
- 136
-1
votes
1
answer
505
views
fuzzing xss mutillidae with OWASP ZAP
I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able ...
1
vote
0
answers
709
views
OWASP ZAP : How to perform authentication when API endpoint only accepts raw XML?
I'm currently working at testing an Angular 6 application using OWASP ZAP. I really enjoy this tool, but like many of us, I struggle with the authentication part, and without it the whole tool turns ...
- 111
1
vote
0
answers
979
views
OWASP ZAP does not scan all urls in Jenkins
I have two set ups with ZAP and Selenium, local and on Jenkins.
Locally, I can start ZAP, run a Selenium process with ZAP as a proxy and then start the spider and then put ZAP in attack mode. This ...
- 109
0
votes
1
answer
883
views
How to configure active scan input vectors in ZAP?
I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code:
private static final String ZAP_ADDRESS = "localhost";
private static ...
2
votes
1
answer
895
views
Running Selenium Jenkins, through OWASP ZAP, before scanning
I suspect that what I am trying to do is something that has been done before. Hopefully, this is possible and someone knows how its done. Any information would be greatly appreciated.
I am attempting ...
- 109
1
vote
1
answer
2k
views
Not able to see WebGoat requests in ZAP proxy
I have configured ZAP to port 8090 and also Firefox to 8090, but I am unable to see any requests from WebGoat lessons, whatsoever, except the initial request of http://detectportal.firefox.com. ...
- 113
0
votes
1
answer
149
views
Benefit of Parameter Map size validation in web application controller
I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
- 41
1
vote
1
answer
636
views
Cross Site Scripting on a Unique Key
Is it possible to perform a cross-site scripting attack by entering my script into a field that is required to match a specific value?
I am scanning an application for vulnerabilities, and my ...
- 109
3
votes
1
answer
299
views
Is there a way to find out what information website queries about us? [closed]
What tool or software should I look for to find out what "fingerprinting" data
a website is tracking?
Like, I want to know, if website looks for a cache and/or fonts installed in system, or Canval, ...
- 141
1
vote
1
answer
5k
views
OWASP ZAP: How to use TLS client certificate authentication?
Is there a way to get OWASP ZAP to send a client certificate?
I have an HTTPS website that receives client certificates for authentication. I have the certificates installed in the browser. ...
- 109
4
votes
2
answers
3k
views
False positive SQL Injection by ZAP with adding new parameter query
I have a spring MVC web application and am running ZAP Active scan on it.
I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
- 41
1
vote
1
answer
4k
views
What is the risk of private IP address disclosure if it is the user IP?
I am checking a web application with OWASP Zed Attack Proxy (ZAP).
There is a vulnerability (low) that says "private IP address disclosure" and when I check for more details I found that it is my IP,...
- 11
0
votes
1
answer
2k
views
How to redirect any response to an arbitrary location in OWASP ZAP's request editor?
I am trying to find stored XSS in an application. Luckily, the application allows me to insert and edit the description of myself that is displayed to anyone visiting my profile.
The location where ...
- 1
1
vote
1
answer
2k
views
Authenticating With OWASP ZAP Script
I am currently working on a python script that will automate zap for me so I do not have to go in and manually fuzz the fields or crawl pages. The part I am stuck on is that my script currently can ...
- 325
0
votes
1
answer
530
views
Running Directory Traversal Against POST Request Headers [closed]
I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
- 1
0
votes
1
answer
733
views
Integrate OData pentesting tool to ZAP add-on [closed]
We are currently working on a ZAP (Zed Attack Proxy) add-on designed to facilitate the pentesting of our new framework.
Our solution is using OData so we were wondering if their was existing tools ...
- 225
1
vote
1
answer
5k
views
Fuzzing with Owasp-Zap
I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form ...
- 325
0
votes
1
answer
1k
views
OWASP ZAP: Infinite Redirect Loop infinitely appending a value to a cookie
I have a website that I need to scan with OWASP's ZAP tool 2.70. It previously worked as long as cookies were enabled.
The site is a .net site proxied by Apache with mod_security. It works with all ...
- 101
1
vote
1
answer
583
views
ZAP: Can't Execute Scripts within Zed Attack Proxy
I try to execute the community script "Extender/HTTP Message Logger.js". I first double click on the script to make it open in the scripting console. However, in the scripting console, the "Execute" ...
- 283
2
votes
1
answer
2k
views
Provide json post data in form based authentification
ZAP provides a way to turn a login (POST) request into a logging pattern (through the "mark as ..." in context menu).
When the data is something like "user=toto&psswd=t@T°", it will translate it ...
- 125
1
vote
1
answer
2k
views
Does the OWASP Zed Attack Proxy project have a list of all the vulnerabilities it tries to find/exploit?
I'm trying to compile a list of vulnerabilities that ZAP tries to find when you run the "Active Scan" in ATTACK mode on a webapp. Does this list exist in the documentation anywhere? If it also has a ...
- 885
1
vote
1
answer
1k
views
How to configure ZAP for Desktop Appliation
I have used ZAP for performing MiTM for Web Applications, what are the settings or methods to perfrom MitM for a Desktop Application ?
Is there a way you could setup ZAP as a system proxy so you can ...
- 237
1
vote
2
answers
167
views
After a full web vulnerability scan, do we need to test each & every similar field for possible injections?
I ran a zap scan for my project and found some medium & low level vulnerabilities. But going through some posts, I found that we should run injections (sql, xss, command) on text fields also.
But ...
- 175
1
vote
1
answer
925
views
How to intercept XmlHttpRequest with OWASP ZAP
I'm using OWASP ZAP for intercepting request to a web application, OWASP WebGoat. My break point is quite simple: 'URL', 'contains', and 'http://localhost:8080/WebGoat/start.mvc#attack/76122667/400&...
- 13
3
votes
1
answer
5k
views
OWASP ZAP teaching spider to use custom header
I need some help with setting up OWASP ZAP to correctly crawl my One-page Angular website with the spider.
I successfully set up a zscript which will handle the login and add a HTTP Session I can set ...
- 519
1
vote
2
answers
4k
views
Zap Proxy - script to modify headers automatically
Hello just wondering if someone already wrote a script for Zap to modify headers automatically with out me having to do it on each response/request..
example.
modify response from 3xx or 4xx to 2xx to ...
- 281
1
vote
1
answer
3k
views
Not able to get response via OWASP ZAP
I have performed the below steps to capture request/response in ZAP :-
Generate the dynamic certificate in ZAP.
Add the Certificate to the browser (FireFox).
Set the local Proxy to 127.0.0.1 and ...
- 121
1
vote
0
answers
635
views
Zed Attack Proxy Fuzzer cookie handling
I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
- 111
1
vote
0
answers
283
views
Mobile internet not working via zap proxy [duplicate]
I have to test the native android application on device, so
I Installed the zap certificated on my device and set the proxy in my device to my system ip where zap is installed and port to 8085.
In ...
- 121
1
vote
1
answer
8k
views
How to run OWASP ZAP automatically using command line operations (i.e. Jenkins) [closed]
I am trying to run OWASP ZAP automatically using command line. I have tried using the API as described here, but I am getting these errors.
I have also tried with zapr, but it's also showing error as ...
- 111
2
votes
3
answers
1k
views
Owasp Zap's active scan harming the database
I want to integrate OWASP Zap security tests in my continuous integration chain using the official Jenkins plugin.
However, since it injects harmful payloads in database, I don't want the database to ...
- 21
1
vote
2
answers
2k
views
How can I intercept localhost traffic to/from WebGoat with ZED attack proxy?
For context I recently started working through the WebGoat appsec training program, and have hit a wall passing data to a program needed to complete a lesson.
One of the first lesson sets is entitled &...
- 11
3
votes
2
answers
457
views
Integrating ZAP to SDLC. Am I doing it right?
We are trying to integrate OWASP ZAP scans to our Build Cycle. When a new build reaches the QA team, they run an automation tool similar to Selenium, which opens a Firefox web-browser in a Windows ...
- 1,307
2
votes
0
answers
933
views
HTTP proxy for smart card based SSL
I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't ...
- 59
3
votes
2
answers
3k
views
How to get CSRF token on authorization request with OWASP ZAP in bruteforce mode
I am a new in OWASP ZAP, so I need your help.
I have vulnerability site - DVWA. I am trying to work on token (CSRF) in bruteforce.
When page load I have HTML form with login, password and user-token....
- 131
5
votes
2
answers
26k
views
Why are HTTPS requests blocked by Firefox when using ZAP proxy?
I have Zed Attack Proxy (ZAP) on my machine and my browser is Firefox. When I route the browser traffic through the ZAP proxy (using FoxyProxy), if it's HTTPS traffic, Firefox says "Your connection is ...
- 369
6
votes
2
answers
2k
views
OWASP ZAP FUZZ functionality not highlighted
I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords.
But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint ...
- 61
1
vote
1
answer
7k
views
OWASP ZAP bruteforce by password not username
I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like:
user001:...
- 409
7
votes
2
answers
23k
views
How can I edit HTTP request in OWASP ZAP and send the edited request?
I'm aware of setting a breakpoint on a particular request and then when the request is made in the browser, the http request can be modified in ZAP. But is there any way in ZAP, by which an already ...
- 351
5
votes
1
answer
3k
views
What wordlist does OWASP ZAP spider use?
I am trying to figure out how OWASP ZAP discovered a directory on a practice vm, I entered the host IP and hit attack, and the spider discovered this directory (pChart2.3.1).
I have searched every ...
- 175
2
votes
2
answers
1k
views
How do I turn off automated testing in OWASP ZAP?
I am trying to find out how to turn off the automated scanner in ZAP. I am not even sure if it is on.
How and where can I tell if the scanner is on? I just want it to be a pure proxy for the time ...
- 197
3
votes
1
answer
1k
views
Why can I only view HTTPS traffic from some iOS apps with ZAP?
I've noticed a curious oddity with some traffic sniffing from my apps on my iPhone. I've installed the ZAP Proxy CA certificate on the device, but I've noticed I can sniff some app traffic, and others ...
- 203
2
votes
0
answers
2k
views
ZAP and Tamper Data is not getting any POST requests
I just started learning the OWASP ZAP Proxy using Webgoat. I am running these on my Mac.
I have configured Zap to listen to my Firefox, but I'm only able to send HTTP GET requests, there are no POST ...
- 29
2
votes
0
answers
1k
views
How to check if "/run timeout /T 5" remote command execution worked on HTML page?
I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea ...
- 95
1
vote
2
answers
14k
views
Exploit SQL injection in OWASP ZAP?
I have done a normal scan (not fuzzing) of a website using ZAP in attack mode, and it gives me several possible injections. My question is if there is any way to try to exploit these within ZAP, ...
- 95
3
votes
2
answers
4k
views
Can the OWASP ZAP check XSS for REST API?
I have a web application and I used OWASP ZAP for checking XSS.
I tried two cases as example bellow:
URL: localhost:8888/test/login
Öogin page HTML:
<!DOCTYPE html>
<html>
<head>
&...
- 31
6
votes
1
answer
20k
views
Setting up OWASP ZAP Authentication
So I have recently been working on security testing with OWASP ZAP. However I have hit a road block in that I can't get the (ajax) spider to test within an authorized area of the single page ...
- 161