How to pass userid and password while doing automated scan in OWASP ZAP

0
votes

Passing user id and password to login page via OWASP ZAP

Hi, I am doing a OWASP ZAP test by building small application with Login and Landing page, but not sure how can i pass userid and password to login page via ZAP Automated scan so that it can scan the landing page,please help.

1
zap

1 Answers

2
votes

Theres a FAQ for that ;) https://github.com/zaproxy/zaproxy/wiki/FAQformauth

Via the UI:

  1. Explore your app while proxying through ZAP
  2. Login using a valid username and password
  3. Define a Context, eg by right clicking the top node of your app in the Sites tab and selecting "Include in Context"
  4. Find the 'Login request' in the Sites or History tab
  5. Right click it and select "Flag as Context" / " Form-based Auth Login request"
  6. Check that the Username and Password parameters are set correctly - they almost certainly wont be!
  7. Find a string in a response which can be used to determine if the user is logged in or not
  8. Highlight this string, right click and select "Flag as Context" / " Logged in/out Indicator" as relevant - you only need to set one of these, not both
  9. Double click on the relevant Context node and navigate to the "Users" page - check the user details are correct, add any other users you want to use and enable them all
  10. Navigate to the Context "Forced User" page and make sure the user you want to test is selected
  11. The "Forced User Mode disabled - click to enable" button should now be enabled
  12. Pressing this button in will cause ZAP to resend the authentication request whenever it detects that the user is no longer logged in, ie by using the 'logged in' or 'logged out' indicator.

Via the API the process is the same but using the API calls:

  1. context/includeInContext

  2. authentication/setAuthenticationMethod

The values for

authMethodConfigParams parameters must be URL encoded, in this case loginRequestData is username={%username%}&password={%password%}