Unable to scan POST api through ZAP

[Dhirendra Pratap Singh]

Hello,

I am unable to perform ZAP scan for my POST api url. Can anyone help me regarding this.?

I need it to generate ZAP scan report and submit it to salesforce for security review.

I am doing following steps-

1. Install ZAP

2.Installing Certificate

   (refer cert.png)

Import generated certificate on certmgr.msc.

3. Configuring Proxy

(refer Local_Proxy_in_ZAP.jpg and Prox_in_LANSettings.jpg)

After that I am able to see target urls in ZAP sites

(refer sites.jpg) but unable to hit post api call through postman after doing configuring proxy step(refer postapierrorinpostman.jpg).

[kingthorin+owaspzap]

Do you have any Scripts enabled or Replacer rules?

[Dhirendra Pratap Singh]

Hello, I am new to ZAP, I haven't enabled scripts or using any Replacer Rules. I need ZAP scanner report for my REST api to submit salesforce security Review. Can you help me where I am going wrong or which steps should I take to generate report for my POST api.  Any thoughts you have will be greatly appreciated.

[psiinon]

ZAP does not change POSTs into GETs by default, so right now we do not know whats going wrong or how to fix it.

What happens if you send the same post request to your app using curl, proxied through ZAP?

Cheers,

Simon