Collaborate Disseminate
I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat.
1 Setup Local proxies in webgoat to run on localhost 8090
2 Exported the certificate and imported it in Firefox
3 Setup Proxy in Fire… Continue reading Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations
While running scans with ZAP, I noticed that many of the reported vulnerabilities involve sending malicious content as a value to a parameter named “query”. For example:
http://<url>:<port>/path/path/path?query=… Continue reading OWASP ZAP uses non-existent parameters
TL;DR Is it a “best practice” to return an HTTP 400 Bad Request response if extra parameters are sent with a request?
I’m putting together a web app and doings some testing with OWASP ZAP. I’m pretty happy with the results -… Continue reading How strict should I be in rejecting unexpected query parameters?
My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I Zap forms-based authenticat… Continue reading Setting up OWASP ZAP Authentication against 2 page forms authenication
Let’s say I’ve edited a request and successfully found a XSS vulnerability. Now, I want to validate that in the browser.
However, since the payload was sent with POST, I can’t just use “Open URL in browser” since it would n… Continue reading ZAP: Evaluate / Show response in browser
I want to intercept an application. It connects to an IP and Port. I have to connect to localhost:443 to make it work(theres a gateway that routes depending on the port).
In Burp I was able to set an invisible proxy on the … Continue reading Redirect OWASP ZAP IP:Port to localhost like in Burp
I want to intercept an application. It connects to an IP and port. I have to connect to localhost:443 to make it work (there’s a gateway that routes depending on the port).
In Burp I was able to set an invisible proxy on the local interf… Continue reading Redirect OWASP ZAP IP:Port to localhost like in Burp
Code:
def zap_start_ascan(self, context, url, policy = “Default Policy”):
“””
Initiates ZAP Active Scan on the target url and context
Examples:
| zap start ascan | context | url |
“””
try:
scan_id = self.zap…. Continue reading ValueError, when trigger Zap Active Scan from Python Code. How to Fix?
I am currently trying to get the OWASP ZAP scanners working on a peculiar website.
When authenticated on this website, each GET request needs a “token” (most likely a anti-CSRF token) as a parameter.
Otherwise, a 302 redirect to the disc… Continue reading Adding a static token to ZAP vulnerability scanner
Is there any way I can automate fuzzing in zap. I know how to do it manually. But is there any way to create test suite and execute?