Adding authentication in ZAP tool to attack a URL

authentication session owasp zap penetration-testing
user2323844 picture user2323844 · Jul 20, 2015 · Viewed 55.1k times · Source

How to pass authentication details to the ZAP tool to scan the website. Please help me to solve the problem.

Answer

fabioresner picture fabioresner · Jun 22, 2016

Quite old question but here it goes.

The most simple way to do this is setting your browser to Proxy through ZAP. On Firefox you can go to:

Options -> Advanced -> Network -> Settings.

Select Manual Proxy Configuration and fill the HTTP Host with the address of the machine running ZAP (most probably localhost) and the configured ZAP port.

You can check and configure ZAP port opening ZAP and accessing:

Tools -> Options -> Local Proxy.

Then open your web browser and login to your application. Now go to ZAP, in the Sites tab (left side of ZAP), select your site, right click on it and select:

Include in Context -> Default Context

Now open the HTTP Sessions tab right click on the session and "Set as Active". (HTTP Sessions Tab: View -> Show Tab -> HTTP Sessions)

Now you can perform ZAP Spider, Active Scan and so with an logged in session. If this is not your scenario, please provide more info about which authentication method your application is using.

Hope it still helps you or someone searching for similar questions. Thanks,

Related questions

PHP Sessions across sub domains

I am trying to set up the following: auth.example.com sub1.example.com sub2.example.com If the user visits sub1.example.com or sub2.example.com and they are not logged in, they get redirected over to auth.…

Read More
What does passport.session() middleware do?

I am building an authentication system using Passport.js using Easy Node Authentication: Setup and Local tutorial. I am confused about what passport.session() does. After playing around with the different middleware I came to understand that express.session() is …

Read More
Authentication, Authorization and Session Management in Traditional Web Apps and APIs

Correct me if I am wrong: In a traditional web application, the browser automatically appends session information into a request to the server, so the server can know who the request comes from. What exactly is appended actually? However, in …

Read More