For source code and notes refer to- [ Ссылка ]
Agenda-
1. Understanding the authentication concept in zap
2. Performing a form based authentication and doing an authenticated scan
3. Understanding how to extract any response value from complex apiresponse of zapClient
Target application might have some sections of application which is only available for logged in users, therefore it is very important to know how to perform authenticated scans in zap.
Types of authentications:-
- Form-based authentication
- Script-based authentication
- JSON-based authentication
General steps when configuring the application authentication with ZAP.
Define a context which
- include the target application inside the context.
- exclude logout page, password change functionality etc.
- Set the authentication mechanism
- Define auth parameters
- Set up login/logout indicators
- Add valid user and password for login
- Make sure that session management is set as "Cookie based session management"
Running a spider using above context, user, site
Install- docker-[ Ссылка ]
Application for form based login-
docker run --rm -p 8090:8080 -i -t psiinon/bodgeit
