Collaborate Disseminate
I’m relatively new to using OWASP ZAP. I tried fuzzing POST requests with Zap and am able to see all the messages sent in the Fuzzer tab.
When I select one of the messages in the Fuzzer tab, I can see the respective Request and Response in… Continue reading Zap: How to export Fuzzer results/report with the Request and Response?
In BurpSuite, you can brute force a password of any length and any character set (in my case, alphanumeric passwords between 1 to 7 characters long). How does one do it in OWASP ZAP, without actually generating a password list containing a… Continue reading Brute force alphanumeric passwords between 1 to 7 characters long with ZAP
Currently, I use zap auto scan and found some vulnerabilities such as missing header and cache control reported by the auto scanner.
Is auto scan good enough to give the dev team a security test report?
I saw a web checklist at OWASP websi… Continue reading Is zap auto scan good enough? [closed]
I want to test an Angular SPA for any DOM-based XSS. How do I do that with OWASP ZAP?
Continue reading How to test an Angular SPA for DOM XSS with OWASP ZAP?
Company wants to start improving security. Test team uses OWASP Zap tool (GUI version) to scan the new version for vulnerabilities. That usually takes between half an hour to 90 minutes.
How to include the scan in a CI/CD in a way it is fa… Continue reading How to include OWASP Zap in CI/CD
Whether there’s a flood or a fallen tree, your power will go out eventually. Here’s how to prepare for an outage that lasts minutes, hours, or days. Continue reading How to Prepare for Power Outages
I wish to map a site with owasp zaproxy. The site uses data driven nodes in the URL in such a format to download image data for maps:
https://subdomain.domain.tld/maps/<<region>>/<<version>>/tiles/<<zoom>&g… Continue reading How to add nested Data Driven nodes in ZAP
Through ZAP, I was able to capture the following from a Change Password form:
GET /rest/user/change-password?current=P@ssword&new=password123
&repeat=password123 HTTP/1.1
Host: localhost:3000
User-Agent: Mozilla/5.0 (X11; Linux x86… Continue reading Capturing data from a Change Password form
First of all, I’m running ZAP in a Docker container and will automate ZAP scans using Jenkins.
The official docker image seems to have a script that performs spidering and active scans but does not do any fuzzing. Is there a way to fuzz th… Continue reading Fuzzing in OWASP ZAP through the command line
I work a lot with OWASP Zap, and I am very satisfied. Nevertheless, I have the problem with all my scans that I always have false positives in the PiiScan area. Among other things, Googlemaps numbers, or product numbers are recognized as V… Continue reading Owasp Zap: False positives in the PiiScan