ZEST action script

53 views
Skip to first unread message

Blazing Wind

unread,
Nov 23, 2020, 6:55:00 AM11/23/20
to OWASP ZAP Scripts
Hi all
I am writing an authentication script in ZEST. The response to the first request gives me a redirect URL that is URL encoded. I saved the URL in a variable, it looks like this:

https%3A%2F%2Fdomain.com%2Fsubdir%2Fsubdir&param=value

Then I want to make a GET request with the URL, but it seems that when it is encoded, it gives me an error:

java.io.IOException: Request does not contain a request-uri.java.io.IOException: Request does not contain a request-uri.

I was wondering how can I decode it within the ZEST script. I didn't find out how I can do it in ZEST, but I saw that I can add a ZEST action "Action - Script" and from what I understand, load a standalone script which would e.g. decode the URL. Writing a short script in Python to decode the value is pretty easy, but I am not sure how to load this ZEST action. And here I wonder:

1. How do I pass the variable with the encoded URL to the Python script?
2. How to write such a script? 
3. After executing the script which will just URL decode the url, how do I return the value to the ZEST script?

The standalone Python script will at least contain:
`import urllib.parse
#pass the variable 'url' with value https%3A%2F%2Fdomain.com%2Fsubdir%2Fsubdir&param=value&param=value from ZEST script to this standalone script and decode it
decodedUrl = urllib.parse.unquote(url)
#return decodedUrl to the ZEST script 
return decodedUrl`

 Below is how I tried to load it:

The obfuscated value is basically the encoded redirectUrl, loaded using {{}}. 

I can't find any example scripts that use this action or documentation - if you find it please share. 

Thanks!

Blazing Wind

unread,
Nov 23, 2020, 6:57:04 AM11/23/20
to OWASP ZAP Scripts
I see I didn't add the screenshot. Here it is:
2020-11-23 12_45_49-Untitled Session - OWASP ZAP 2.9.0.png
Reply all
Reply to author
Forward
0 new messages