Question regarding creating an add-on.

[patel harshil]

Hello devs,
I'm new to ZAP and want to build an add-on that just add payloads strings to the current mouse pointer.
ex. : https://site.com/products?=10[PAYLOAD]&category=toys in the "Request panel" via right click menu and in some cases ask users for input like for ex. :
"How many tables you've find out?" -> user inputs "5".
So, the PAYLOAD would be like this. https://site.com/products?=10'+UNION+SELECT+1,2,3,4,5--

I want a custom entry in right click menu with 4-5 sub menus.
ex. :

• AddOn Name
  • XSS PAYLOADS
    • PAYLOADS CATEGORY 1
      • 20-25 PAYLOADS....
    • PAYLOADS CATEGORY 2...
      • 20-25 PAYLOADS
    • PAYLOADS CATEGORY 3...
      • PAYLOAD SUB CATEGORY
        • 20-25 PAYLOADS
  • SQLi PAYLOADS
    • PAYLOADS CATEGORY 1
      • 20-25 PAYLOADS....
    • PAYLOADS CATEGORY 2...
      • 20-25 PAYLOADS
    • PAYLOADS CATEGORY 3...
      • PAYLOAD SUB CATEGORY
        • 20-25 PAYLOADS

I know the back-end side logic using JAVA and PYTHON but, the problem is that I don't know where to start for front-end and what api should I use to do this thing?

the idea here is to I don't want to go back and forth between my payloads files and zap..!!!
I know I can add payloads into Fuzz Panel and start fuzzing things. but, it's not good to fuzz things for 2-3 payloads (I think) and it took extra 2-3 steps.

[psiinon]

Hiya,

OK, what you're trying to do is non trivial .. but should still definitely be possible.

I'd recommend using java rather than python otherwise you'll be in for a world of pain ;)

First you will need to set up your dev environment and create an add-on - thats all documented under https://www.zaproxy.org/docs/developer/

The simple example actually includes RightClickMsgMenu.java which adds a right click menu to panels that list HTTP messages, so thats a good start.

You can lanuch a dialog from there to collect the user input.

The nested set of submenus, which might be "interesting" as we dont typically do that in ZAP.

But you'll have access to all of the standard java swing functionality so it might be straightforward, depending on your experience.

Hopefully thats enough to get you started...

Cheers,

Simon