modify request/response

[nwg]

I am brand new to ZAP today and have been scouring the web trying to find a simple example of scripting to automate the modification of a response or a header.

The goal here is to redirect a request to something like a css file to a local file or even to a file on a localhost.

I was recently forced onto a mac machine and this is something I know how to do with fiddler on a win machine but that isn't an option anymore.

Any help would be most appreciated. 

Is there a script cook book somewhere that I didn't find? Something like this: http://docs.telerik.com/fiddler/KnowledgeBase/FiddlerScript/ModifyRequestOrResponse

I did see the unofficial repo and will start poking around in there as well.

Thanks

[gmaran23]

Well, luckily you are in good hands.

Have you checked the existing script templates? Available at [Open ZAP] --> Scripts (on left top) --> Scripting --> Templates --> Proxy --> and there you go, how to modify request or response, a lot of samples. 

You can create a ZEST script from any of these existing templates and modify a anything in a request or response. You can also enable or disable your script at will. 

ZEST is very easy UI based scripting. Here's is a nice blog to demonstate that. http://dunnesec.com/category/tools/owasp-zap/owasps-zest-scripting/ . I have scripted in fiddler, and ZEST scripting is child's play :)

Let us know how it works for you.

[kingthorin+owaspzap]

Just check the thread list in the group you posted to :)

"Javascript / Proxy / Conditional request rewriting"

[nwg]

Thank you both for pointing me in the right direction. I am playing with this again and while I have found the template my values in the fields aren't working.

I think my regex works for finding the correct request urls but my attempts to replace and reroute that are failing.

for my replace value I am using the regex: http.*css/

my replace is then: /Users/<filepath>/css/

is it possible to replace a request url with a local file?

[kingthorin+owaspzap]

Access local files via the file:// handler

http://en.wikipedia.org/wiki/File_URI_scheme#Unix

Using your RegEx only matches the first occurence:
https://regex101.com/r/iY8nQ9/1

If you use /g then you'll match all (note the invalid match on line 2):
https://regex101.com/r/iY8nQ9/2

This script may give you some help with RegEx usage:
https://groups.google.com/d/msg/zaproxy-scripts/v8DCjjT3TxM/NSiPikI98JQJ

[nwg]

I can't seem to get local files to load no matter how I format them.

I have been trying to use the file handler article you linked to but no matter how I format the file for my mac machine the request never gets a file loaded.

file:///Users/user/Documents/main.css

file://Users/user/Documents/main.css

file:///MacintoshHD/Users/user/Documents/main.css

file://MacintoshHD/Users/user/Documents/main.css

I have been able to redirect the request to a different css file hosted somewhere else which is helpful to a degree but for my purposes I really need to load a local file.

Is there any type of proxy setting in ZAP or my browser that could be blocking these requests?

[Simon Bennetts]

Browsers probably access local files directly and dont use the proxy settings.
The only way around this I can think of is to have a local web server and access them that way.

Simon

[nwg]

Based on tools like NProxy: http://goddyzhao.me/nproxy/

Which I can use when I am not on my corp network I know browsers can/do send those requests through a proxy.

Is this something that could be a feature request for ZAP?

[Simon Bennetts]

I'm sure it could be :)
But could you explain exactly what you want the feature to provide?

Cheers,

Simon

[nwg]

My goal is to replace certain css files being called by the browser with local copies.

From my tests it appears that ZAP can't replace http requests with file:// handler paths. 

I linked to NProxy previously which may be operating on something other than the request but is able to do this. It just doesn't support an upstream proxy like ZAP does. 

[Simon Bennetts]

Can you share your script?
I can see why this would be useful and if ZAP doesnt currently allow it then we should be able to fix it so that it does.

Cheers,

Simon

[kingthorin+owaspzap]

I just did a quick PoC for this with images. Firefox and IE don't seem happy to load images using the file:/// handler when content was served remotely.....I didn't test this extensively but it seems like a browser issue not a ZAP issue.

However if I setup a local web server[1] it was quite easy to do the replacement of remote content with local content (http://localhost/<whatever>). I just used a proxy script and setup the proxyResponse function to look for a page containing the thing I wanted to replace then did a:

msg.setResponseBody(msg.getResponseBody.toString().replace("http://somesite.com/thing.jpg","http://localhost/bullseye.jpeg");

when the condition was met.

[1] I find TinyWeb handy: https://www.ritlabs.com/en/products/tinyweb/

[kingthorin+owaspzap]

nwg, did you ever come up with a working solution?

[nwg]

I am working on a deadline at work and haven't been able to play with this recently but I will get back to it soon I hope.

One comment I do have is that I don't believe it to be a browser issue because I can use nProxy with any browser on my mac.