Collaborate Disseminate
I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords.
But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint and non clickable.
Ho… Continue reading OWASP ZAP FUZZ functionality not highlighted
I am a beginner with ZAP. I am trying to use FUZZ logic for the passwords.
But I can see that option when I click on the password at the request table but I am not able to click on it, as it is faint and non clickable.
Ho… Continue reading OWASP ZAP FUZZ functionality not highlighted
I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like:
user001:pass00
user002:pass00
…… Continue reading OWASP ZAP bruteforce by password not username
I’m aware of setting a breakpoint on a particular request and then when the request is made in the browser, the http request can be modified in ZAP. But is there any way in ZAP, by which an already made request can be edited … Continue reading How can I edit HTTP request in OWASP ZAP and send the edited request?
I am trying to figure out how OWASP ZAP discovered a directory on a practice vm, I entered the host IP and hit attack, and the spider discovered this directory (pChart2.3.1).
I have searched every wordlist used by dirbuster … Continue reading What wordlist does OWASP ZAP spider use?
I am trying to find out how to turn off the automated scanner in ZAP. I am not even sure if it is on.
How and where can I tell if the scanner is on? I just want it to be a pure proxy for the time being for testing purposes.
Continue reading How do I turn off automated testing in OWASP ZAP?
I need to do a pentest of the DVWA application. To do that, I chose the OWASP-ZAP tool. I followed all the steps of this tutorial. But when I try to run the “spider” the program doesn’t find all the pages, so when I want to s… Continue reading OWASP-ZAP and DVWA Login
I just started learning the OWASP ZAP Proxy using Webgoat. I am running these on my Mac.
I have configured Zap to listen to my Firefox, but I’m only able to send HTTP GET requests, there are no POST requests showing up.
I … Continue reading ZAP and Tamper Data is not getting any POST requests
I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea how to check to see if it’s… Continue reading How to check if "/run timeout /T 5" remote command execution worked on HTML page?
I have done a normal scan (not fuzzing) of a website using ZAP in attack mode, and it gives me several possible injections. My question is if there is any way to try to exploit these within ZAP, without using SQL map myself?
… Continue reading Exploit SQL injection in OWASP ZAP?