Questions tagged [zap]
OWASP Zed Attack Proxy (ZAP)
486
questions
0
votes
1
answer
22
views
How to prevent OWASP ZAP scanner hitting external URLs in Standard Mode?
I am new to OWASP ZAP. I ran a automated scan in Standard Mode on my own website hosted on localhost (http://127.0.0.1:8000) with both traditional and AJAX spiders.
There are some external public URLs ...
0
votes
0
answers
15
views
Where to Install OWASP Benchmark?
I am trying to scan the OWASP Benchmark with ZAP. However, I am having trouble getting the Owasp benchmark up and running. I have installed maven and the jdk required. I have ran the ./runBenchmark.sh ...
1
vote
1
answer
37
views
Get report from OWASP Zap session
I'm trying to get OWASP ZAP to run while I run my cypress tests. I think have it working but can't get a human readable report out. I'm running the daemon
cross-env-shell java -jar ./zap/zap-D-2022-05-...
1
vote
1
answer
22
views
OWASP-ZAP: How to Pause traditional spider using script
I have an requirement where I need to pause spider on the following condition
when response code is 302
when response header has location with value set to login page eg: "login.jsp"
...
1
vote
2
answers
70
views
CSRF issue on liferay 6 CE on login page
I am using Liferay 6.2-ce-ga6 with tomcat 7.0.62, I'm trying to update it and fix some vulnerability issues, according to OWASP security reports.
The tool (OwaspZap) reports to me problems with some ...
0
votes
0
answers
38
views
ZAP CLI url_not_found error when running an authenticated scan
I recently encountered an issue using zap-cli, I'm trying to do the same thing than at:
https://www.zaproxy.org/docs/api/?python#script-based-authentication
In other words scanning dvwa docker ...
0
votes
1
answer
49
views
"No Internet Connection" for iOS Apps Being Proxied Through OWASP ZAP
Sort of a newb to OWASP ZAP/proxying apps through it, so I'm tagging OWASP in this post, but hoping someone knows how to circumvent this issue here.
On Windows 10, OWASP ZAP 2.11.1, I've generated a ...
0
votes
2
answers
80
views
OWASP ZAP Full Scan Authenticated on Gitlab CICD
I want to do a zap full scan on gitlab cicd with authentication to the website i want to run it (without the DAST module from gitlab)
i can run the zap-full-scan.py properly but dont know how to add ...
0
votes
1
answer
23
views
Zap2Docker custom scan rules
I'm trying to find a way to write my own OWASP zap scan rule for the purpose of running a baseline scan using zap2docker's baseline_scan.py and define the rule severity (info/warn/fail) in the docker ...
0
votes
2
answers
107
views
OWASP ZAP fuzzer header and body
I'm learning how use OWASP ZAP and I'd like to know how fuzzer at the same time the header and the body in a request using the same payload script. I am trying to do this lab for practise:
https://...
0
votes
1
answer
12
views
Testing in Zap, suggests me to fix SQL Lite when I'm using Postgres as my database
I Have built my backend in Laravel 8+ and PostgreSQL. While testing my API for security fixes, I get the security error of possible SQLi error through SQL Lite and Mongo DB. Since I have not used any ...
0
votes
1
answer
28
views
Django i18n External Redirect security issue
(I'm new with Django)
I ran an automated scan (OWASP ZAP) to test my application security and it's returning a high risk flag for External Redirect:
Automated Scan Alert
Looks like it's something to ...
0
votes
1
answer
72
views
How to set up a transparent(invisible) proxy with owasp zap?
Burp suite can be set by checking "Support invisible proxying".
I can't find the transparent proxy settings in ZAP.
0
votes
1
answer
61
views
Why there is difference in Active scan report for same application in ZAP TOOL
I am using ZAP TOOL for security testing and
Doing two active scans for the same application without changing anything, the results are different.
For example, in the first scan for the same url it ...
0
votes
2
answers
29
views
How does ZAP pass the JavaScript validation input?
I applied JavaScript validation inputs for the username input on the registration form, which is
function username_validation(){
var username = document.getElementByname("username1").value....
2
votes
1
answer
93
views
OWASAP ZAP vulnerability diagnosis cannot be performed with services using Firebase
I use OWASP ZAP to diagnose vulnerabilities in my own web service.
However, the web service function does not work properly via the ZAP proxy. When I checked the ZAP log, an error occurred in the ...
0
votes
0
answers
59
views
Log Reuqests made by OWASP ZAP API scanning
I have a local OpenApi schema that I want to scan with OWASP ZAP using their docker image. However, the report I get does not show me whether ZAP forms correct request bodies. Is there any way to log ...
0
votes
0
answers
30
views
I'd like to scan the metasploitable2 VM with zap api scan (the docker one) using a context file but it seems the authentication doesn't work
I am working on scan automatisation and trying it on metasploitable2 VM using the following command:
docker container run --rm -v $(pwd):/zap/wrk --name container01 owasp/zap2docker-stable:latest zap-...
0
votes
0
answers
149
views
ZAP API Scan fails to parse swagger definition
I have .NET 5 API that I am running a ZAP API scan against .
When I run this command from Windows 10 it works perfect and the report is generated - for this first use-case I have the API hosted in IIS ...
0
votes
0
answers
93
views
Open Source Vulnerability scanning tool to find JSON Injection issues
I have to do a vulnerability scan in our web application to find JSON Injection issues. I tried in OWASP ZAP, Burp Suite but not able to find the issues. Could anyone suggest a good open source ...
0
votes
0
answers
48
views
Is it possible to link Owasp Zap and Browserstack,Crossbrowsertesting.com or SeleniumGrid?
Details:
Currently I used Owaspzap with a connection to Postman, and via the api in the local area. But we also want to connect to Browserstack or Crossbrowsertesting.com to test our mobile pages for ...
0
votes
1
answer
198
views
ZAP Error [java.net.SocketException]: Connection reset
I launch our application for test with chrome browser using the manual explore option from zap and getting the below error. I save the SSL certificate from ZAP and imported to chrome browser, still ...
0
votes
2
answers
141
views
Integer overflow attack mitigation in Spring Rest API
We are currently undertaking security vulnerability assessment of our webapps. For this we have been using the ZAP tool from OWASP for automated penetration testing. One of the alerts we received from ...
0
votes
1
answer
422
views
Set authentication header in zap docker based API scan
I am trying to use zap api scan in zap docker image. APIs are OIDC authenticated. Authentication is performed using "Graal.js" script and access token is set as global var using org.zaproxy....
0
votes
1
answer
158
views
ZAP security testing in Mobile - unable to launch app or browser via connected wifi after changing Proxy to manual in mobile ( both android and IOS )
First I did the below mentioned steps:
"
First you need to install the certificate in your mobile device for ZAP to record it. You can do that by following steps:
Open ZAP
Go to Tools
Click in ...
0
votes
1
answer
29
views
Github Actions OWASP ZAP full vs API scan
Is the api scan included in the full scan for the OWASP ZAP Action Full Scan for Github Actions? I need to know if I need to include a separate scan for APIs, or if its already covered by the full ...
0
votes
1
answer
112
views
OWASP ZAP: Active scanning manual explored Actions
I started, with an automatic scan of my site under test.
Then I have explored it manually to test actions, not found by the automatic scan.
These Actions are visible in the History Tab.
I stored the ...
-1
votes
1
answer
279
views
How to check the log4j vulnerability in geoserver?
I am trying to check the log4j vulnerability in GeoServer, On before and after updating the old log4j package to the new package which resolves the issue. For that, I am using the Zap tool for ...
0
votes
1
answer
152
views
Can we use owasp zap for mobile application
I'm trying to build a react native application,(mobile app). Can I use owasp zap for security testing. Or owasp zap only for website and web application.
0
votes
1
answer
29
views
How to render your own HTML page in zaproxy while analyzing an incoming request
We are developing a new extension for Zaproxy (in the specific zap-extensions repo), which checks incoming requests and shows an HTML page if for example a 'bad' password has been detected (assume the ...
0
votes
3
answers
92
views
How to run a bash script that takes multiple user intactive inputs , as part of dockerfile
I have the below dockerfile that needs to run a owasp bash file for its intallation.
This .sh file needs multiple inputs(like 1, Y, enter) from the user for the completion of installation.
How do I ...
0
votes
0
answers
230
views
OWASP ZAP Docker Full Scan Fails with Proxy Error
I am attempting to perform a full scan against my application using the OWASP ZAP docker packaged scan, however the scans are failing to connect to the proxy with ProxyError, and the error seems to be ...
1
vote
2
answers
327
views
zap-api-scan.py: How to limit the time / recursion / depth?
I have a command for zap-api-scan.py, but unlike zap-full-scan.py, there seems to be no way to limit these.
via OWASP's official docker image:
docker run -v $(pwd):/zap/wrk/:rw \
-t owasp/...
0
votes
1
answer
150
views
Issue with owasp zap plugin in jenkins
While using owasp zap plugin in jenkins and building a freestyle project, it is asking to fill on various details like authentication, source details and project key. Can any body help me out with it?
0
votes
1
answer
243
views
Including Keycloak authentication for docker OWASP ZAP container
I'm working on a solution that involves running a the owasp/zap2docker-stable image in order to fully scan a web app that implements Keycloak for authentication and user management.
If I'm ...
0
votes
0
answers
74
views
Zap scan not working when I automate the log in steps using gherkin script
I start ZAP in desktop mode and then start selenium browser with the HUD menu. Then I'm able to successfully login to my app using my gherkin steps (which I can see happening on the browser) and then ...
0
votes
1
answer
92
views
Need help to intercept Bluetooth Low Energy (BLE)communication through OWASP ZAP
I have a requirement to security test a Mobile app which is standalone and connects to firmware through Bluetooth Low Energy (BLE).
0
votes
1
answer
304
views
ZAP API Scan failing with error Read timed out
I am able to do an API scan as well as generate a report when I run the below command from Windows :
docker run -v "$(pwd):/zap/wrk/:rw" -t owasp/zap2docker-weekly zap-api-scan.py -t http://...
0
votes
1
answer
63
views
ZAP API Scan failing with invalid mount directory error
When I attempt to run the following ZAP command on the terminal (Debian 10) :
docker run -v '$(pwd):/zap/wrk/:rw' -t owasp/zap2 docker-weekly zap-api-scan.py -t http://10.170.170.170:1700/account?...
0
votes
1
answer
221
views
Getting Authentication failed for user on running owasp ZAP scanAsuserAPI
I have used ZAP Desktop using form based authentication, zap runs perfectly fine on Desktop app. However as the web application i am using also has _csrf_token is passed along with username and ...
0
votes
1
answer
100
views
OWASP ZAP full scan stopped working in CICD pipeline
I have been experimenting with running ZAP in an Azure CI pipeline and it's been going fine until today; I was running the pipeline and right when it got to running the zap full scan, it froze. I ...
0
votes
1
answer
83
views
How to add false positive using XSLT file in OWASP ZAP scan in Azure DevOps?
I have integrated OWASP ZAP into my Azure Pipeline. After the completion of the build, the report I am getting also contains some false positive issues (an issue that isn't feasible for my application)...
0
votes
1
answer
250
views
How do I mount zap/wrk directory for ZAP API Scan on Windows
I am trying to run a ZAP API scan against an API but when I run the command below I get error "Invalid option v : option -v not recognized" :
docker run -t owasp/zap2docker-weekly zap-api-...
1
vote
1
answer
2k
views
Getting error "A problem occurred while processing the request" while integrating ZAP with Jenkins
I am trying to integrate ZAP with Jenkins and following https://www.linkedin.com/pulse/owasp-zap-integration-jenkins-devsecops-pipeline-basic-arpit-mittal
I am using Mac machine and Jenkins is ...
2
votes
1
answer
379
views
OWASP Zed Attack Proxy Scan in DevOps pipeline
My requirement is do the "Authenticated Scan" by using the TFS DevOps pipeline, for this I added the "OWASP Zed Attack Proxy Scan" extension under TFS and added the tasks in ...
0
votes
1
answer
23
views
Using OWASP ZAP with Shibboleth?
I have scanned the OWASP documentation and the login methods that are details in said documentation don't appear to be related to applications that are using Shibboleth.
For those that have worked ...
0
votes
1
answer
67
views
Get Exception in thread "main" org.zaproxy.clientapi.core.ClientApiException: Does Not Exist on running form ans script authentication using zap api
public class FormAuth {
private static final String ZAP_ADDRESS = "localhost";
private static final int ZAP_PORT = 8080;
private static final String ZAP_API_KEY = null;
private static final ...
-1
votes
1
answer
228
views
Security Vulnerability XSS Dom based
We are using the ZAP tool for our application security testing and running across a High priority vulnerability in form of Cross site XSS DOM based. Attached image for reference.
Can someone help to ...
0
votes
1
answer
92
views
'request hooks' for Owasp ZAP
Is there a way I can trigger some action once a particular request is issued in ZAP?
For example, I want to send a POST request to an endpoint whenever there is a login/logout request.
Environment: I'...
0
votes
0
answers
214
views
OWASP ZAP - Unable to intercept SOAP API requests
I am new to the ZAP and trying to pen test XML(SOAP) services. I already have Java based regression tests for the SOAP and trying to proxy them through ZAP, but unable to do so.
I am looking for some ...