Hot answers tagged

10

These automated checks work by putting a script tag containing a random token into every field. For example, /someRequest?foo=x&bar=y might become: GET /someRequest?foo=<script>alert("147230578")</script>&bar=<script>alert("561972456")</script> It maintains a map of fields and the random values it chose (in this case foo=...


9

ZAP creates certificates, on the fly, in the name of the site Firefox is going to. Firefox is saying "I don't trust the CA that signed this cert", which is reasonable, because it's a MITM by an unapproved certificate authority. You need to import Zap's signing certificate into Firefox's Trusted Roots Certificate Store. If you Google "zap install ...


7

Run the active scans against a non-production environment (replica of production). Have a process/script to easily restore a fresh copy of the live database if you break your non-production database during the active scanning. It is best practice to avoid unnecessary risk on the production site. Also, you can be much more aggressive with your penetration ...


5

It all depends on how your application handles the fields. If it handles them in exactly the same way then yes, in theory you only need to scan one of them. However this is not the normal case, applications usually use fields differently. There are various ways to speed up ZAP scans - see this blog post: https://blog.mozilla.org/security/2013/07/10/how-to-...


5

Short Answer: No. (at least not in the versions I have worked with) Longer Answer: ZAP is not an exploitation tool, it is a vulnerability detection tool. You can however fuzz with ZAP to determine if SQL injection is possible but as it already detected a possible SQL injection the next step is exploiting it in order to verify if it is a true / false ...


5

OWASP ZAP is like a MITM proxy very similar to Burp suite.Ofcourse it can read the https because you must have installed a Root CA certificate while setting it up.There is nothing wrong with your website in regards to your question


5

It is true that both tools are in the same space. Burp is a commercial closed source tool (which can be extended) developed by a commercial company while ZAP is a free open source tool developed by the community. Both have relative strengths and weaknesses, but as the ZAP project lead I'll let others enumerate those as I'm kind of biased. Having 2 tools ...


4

For future reference: ZAP works as spider. Spiders crawl through data and find connection points in nodes. Webspiders follow links, sources, anchors in HTML, JS and CSS. Every time a connection is found, it is added to the source tree, creating an hierarchical data structure knows as a searchtree. To give a simplified example: \-root |-page |-page | ...


4

You can use the Zest functionality of ZAP to perform your authentication. In the icon bar on the top, on the far right you will find a tape icon that says "Record new Zest Script...". Hit it, choose a name and choose "Authentication" for the "Type" dropdown. Now open the a browser via ZAP and manually perform a login to you site. Stop the recording by ...


4

Can't fuzz in Safe Mode. Core help info on modes here: https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsModes ZAP has a 'mode' which can be: Safe - no potentially dangerous operations permitted Protected - you can only perform (potentially) dangerous actions on URLs in the Scope Standard - as in previous releases, you can do ...


4

You shouldn't be running any tests against a live database, You should be using a segregated testing environment


4

There's a core help for that, even has Firefox specific info (along with others): https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsDynsslcert#mozilla-firefox After you've exported and saved ZAP's CA cert: Firefox is using it's own certificate store. Thats why you have to import it twice, when you're using both browser on windows. ...


4

As usual when using automated scanners, you'll need to do some manual testing to confirm this vulnerability or reject it as a false positive. Why would ZAP label this as XSS? From the ZAP documentation (thanks @SimonBennetts): Cross Site Scripting (reflected) This rule starts by submitting a 'safe' value and analyzing all of the locations in which ...


4

Have a look at your Firefox proxy settings again. By default Firefox will set 'No proxy for' 127.0.0.1 and localhost. If you've got WebGoat running locally then you'll want to clear that field so that Firefox proxies local requests through ZAP.


3

We have a FAQ for that :) https://github.com/zaproxy/zaproxy/wiki/FAQzaptests ZAP has a built in set of 'input vectors' https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsAscaninput but you can also define your own via script input vectors: https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsScriptsScripts


3

Is it working for you? If so then yes, you are probably doing it right ;) ZAP is a very flexible tool and many people use it in different ways. One question - are you restarting the ZAP instance, eg for each scan or after a period of time? If not you may run into issues as ZAP is not really designed to be run as a long running process. We are working to ...


3

You need to add your app to a Context and then set up HTTP Authentication for it: https://github.com/zaproxy/zap-core-help/wiki/HelpStartConceptsAuthentication#httpntlm-authentication


3

Yes, it is generally still possible, but techniques like Certificate Pinning and others make it more and more difficult to do a Man-in-the-Middle Attack. I've also observed quite a lot of apps (on Android though) and found that especially messaging and communication apps (Facebook, Snapchat, ...) try to make sniffing network traffic as hard as possible. ...


3

Fuzzing is not a technique to find known vulnerabilities. That is the job of an active security scanner like you said. Instead, a fuzzer is designed to assist with finding new bugs that are not yet known. They do this by constructing random or pseudorandom input and feeding it to the target. Good fuzzers will be format-aware and will feed it input that ...


3

Yes, its added by this code: https://github.com/zaproxy/zaproxy/blob/develop/zap/src/main/java/org/parosproxy/paros/core/scanner/VariantAbstractQuery.java#L148-L153 This is added to see how webapps react to queries - if they handle them badly then yes this can introduce vulnerabilities. If you think ZAP has reported false positives then please report them ...


2

The ZAP reporting could definitely do with some improvements. However you can access all of the alerts via the ZAP API in JSON and XML format. If you enable the API (via the options) you can then access a URL like: http://zap/JSON/core/view/alerts/?baseurl=http%3A%2F%2Fwww.example.com%2F&start=&count= to get all of the alerts reported on www....


2

tl;dr -- Use ZAP to find the username and password parameters, and then Hydra with the -u switch to brute force logins, iterating through users instead of passwords as you asked. EDIT: you can also use Burp Intruder using Cluster Bomb to cycle through. Works pretty well but not quite as fast as Hydra if memory serves correctly. There may be a similar ...


2

Did you try right click, "resend"? Then you get a new window and in the "Request" tab you can change the parameters. Maybe it doesn't work in the "Sites" pane and you need to go to the "history" tab in the bottom.


2

Setting the proxy host and port and clearing the 'No proxy for' field is all you should need to do. Have you tried refreshing the relevant WebGoat page (Ctrl-Shift-R)? I use ZAP to proxy to local applications all the time on Linux, Windows and Macs with no problem. Btw ZAP is not the new name for WebScarab, its a completely different product ;) But ...


2

Authenticated scans are tricky beasts. They do work, but can be tricky to set up. We have a FAQ which explains about form based auth: https://github.com/zaproxy/zaproxy/wiki/FAQformauth - its still relevant to other forms of auth, esp the trouble shooting section. You can also inject headers directly using the Replacer add-on.


2

With ZAP Fuzzing you can specify any number of locations to fuzz in a request. However if you want to apply specific attacks and know what results you're looking for you might be better off with writing an active scan rule. We have various examples here: https://github.com/zaproxy/community-scripts/tree/master/active


2

This is more of an issue when the private IP address belongs to the server, since it can give an indication of how the infrastructure of the website is configured. For example, if you find some method of scanning from the server, knowing the IP range it's on saves a lot of time when looking for other systems - only having to scan 192.168.1.1-255 is a lot ...


2

You should be able to add any certificates that you need to use via the ZAP Options / Certificate screen (https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsCertificate).


2

No, there is not. While fingerprinting can be done by actively providing the browser with a resource that will allow for fingerprinting, it is also possible to fingerprint a client entirely passively. For example, the specific order that client headers are transmitted in gives away the web client you are using. Even if you spoof various headers like accept ...


2

Using Zap? No, other than setting up the word lists and launching it (which is what I assume you mean by doing it manually). Using python or another scripting language? Yes, absolutely, and this is very common with pen-testers who do it often.


Only top voted, non community-wiki answers of a minimum length are eligible