Collaborate Disseminate
I am currently working on a python script that will automate zap for me so I do not have to go in and manually fuzz the fields or crawl pages. The part I am stuck on is that my script currently can only crawl the web login ma… Continue reading Authenticating With OWASP ZAP Script
I’m trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request. I am trying to modify t… Continue reading Running Directory Traversal Against POST Request Headers
Since spider searches and scans all website pages and gives alerts, and active scanning also scans the pages found by spider and gives alerts, why do we need active scanning when we can just spider the website instead?
We are currently working on a ZAP (Zed Attack Proxy) add-on designed to facilitate the pentesting of our new framework.
Our solution is using OData so we were wondering if their was existing tools that we could have integrat… Continue reading Integrate OData pentesting tool to ZAP add-on
I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form fields on a page? I heard… Continue reading Fuzzing with Owasp-Zap
I have a website that I need to scan with OWASP’s ZAP tool 2.70. It previously worked as long as cookies were enabled.
The site is a .net site proxied by Apache with mod_security. It works with all major browsers such as Fi… Continue reading OWASP ZAP: Infinite Redirect Loop infinitely appending a value to a cookie
I try to execute the community script “Extender/HTTP Message Logger.js”. I first double click on the script to make it open in the scripting console. However, in the scripting console, the “Execute” button is disabled and I see no other wa… Continue reading ZAP: Can’t Execute Scripts within Zed Attack Proxy
ZAP provides a way to turn a login (POST) request into a logging pattern (through the “mark as …” in context menu).
When the data is something like “user=toto&psswd=t@T°”, it will translate it into
“user={%username%}… Continue reading Provide json post data in form based authentification
After the initial information gathering phase, it is possible in ZAP to export or list any dynamic content and the respective parameters in a structured way, i.e., excluding the any static content (images, html pages, etc.)? … Continue reading Zed Attack Proxy: enumerating dynamic contents and associated parameters
I’m trying to make a presentation on how to scan a website using OWASP ZAP 2.7.0 and I’m trying to use WebGoat7.1 as a target for this purpose. I would like to first use the AJAX scanner to discover all the lessons pages so t… Continue reading How can I scan WebGoat7.1 with OWASP ZAP