Collaborate Disseminate
I’ve heard a lot about fuzzing website parameters with programs like OWASP-zap but what is the importance of it? A simple active scan finds vulnerabilities in a website such as XSS. So why do we need the fuzzer?
If someone … Continue reading What is the importance of fuzzing?
I have a rooted bluestacks android. I would like to use ZAP to monitor its SSL traffic.
I exported ZAP’s SSL certificate as a .cer file (“—– BEGIN CERTIFICATE …. —— END CERTIFICATE ——-“). Now I wish to imported … Continue reading How do I install the OWASP ZAP certificate as a trusted system CA on Bluestacks? [migrated]
I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able to manually provoke a XSS … Continue reading fuzzing xss mutillidae with OWASP ZAP
I’m currently working at testing an Angular 6 application using OWASP ZAP. I really enjoy this tool, but like many of us, I struggle with the authentication part, and without it the whole tool turns into a nothing burger.
Th… Continue reading OWASP ZAP : How to perform authentication when API endpoint only accepts raw XML?
I have two set ups with ZAP and Selenium, local and on Jenkins.
Locally, I can start ZAP, run a Selenium process with ZAP as a proxy and then start the spider and then put ZAP in attack mode. This will turn up a number of is… Continue reading OWASP ZAP does not scan all urls in Jenkins
I want to develop an application using the ZAP API for Java that performs an active scan over a site. I have the following code:
private static final String ZAP_ADDRESS = “localhost”;
private static final int ZAP_PORT = 8090;
private stat… Continue reading How to configure active scan input vectors in ZAP?
I suspect that what I am trying to do is something that has been done before. Hopefully, this is possible and someone knows how its done. Any information would be greatly appreciated.
I am attempting to run both Selenium and… Continue reading Running Selenium Jenkins, through OWASP ZAP, before scanning
I’m trying to run ZAP with remote access to it. I tried tun ZAP with parameters
-daemon -config api.disablekey=true -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true
But while I’m able to access it via loca… Continue reading Remote access to ZAP
I have configured ZAP to port 8090 and also Firefox to 8090, but I am unable to see any requests from WebGoat lessons, whatsoever, except the initial request of http://detectportal.firefox.com. Herewith attached the screensho… Continue reading Not able to see WebGoat requests in ZAP proxy
I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller expected 10 parameters and the request has… Continue reading Benefit of Parameter Map size validation in web application controller