Use ZAP to listen to https requests on public ip

[yipman]

Hi,

I want to run ZAP on my ubuntu VPS and listen to the public server ip with changing the proxy settings in Firefox in my PC to the Server public ip and the listener port, as i see it's working fine with http requests but it's not working for https, how i can make it to listen to https requests?

Thanks.

[thc...@gmail.com]

Hi.

Could you explain what's not working? The HTTP and HTTPS requests are
handled in the same port, if one is working the other should as well.

Did you import/trust ZAP's Root CA cert?

Best regards.

[yipman]

Hi,

Thanks for your reply,

yes, as in my question i exported the zap certificate that in my VPS and downloaded  it in my PC and imported it to Firefox, only HTTP requests working but HTTPS getting "Secure Connection Failed" but google.com or facebook.com or twitter.com there are no problem these website is working fine, but i don't know what is the problem :(

Thanks.

[yipman]

for example if i tried to open https://google.com it's working fine, but if i try to open this Website https://www.gillette.co.uk or  https://www.urbandictionary.com or 90% of https websites it's will not working!

Thanks.

[yipman]

the response will be "Secure Connection Failed"

[thc...@gmail.com]

That's most likely because of HSTS if it's just some specific sites that
are not working. You could try with a clean profile to make sure.
https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html

Might also worth checking:
https://www.zaproxy.org/faq/how-can-zap-test-sites-that-use-certificate-pinning/

Best regards.

[yipman]

Thank you for your reply,

Unfortunately, it's not working i tried the way in this URL https://www.zaproxy.org/faq/how-can-zap-test-sites-that-use-certificate-pinning/ and other ways from google but there are no thing working :(

[thc...@gmail.com]

Did you try with clean profile?

Best regards.

[yipman]

Yes, i tried it now in private firefox mode, and it's not working too only google.com and youtube.com facebook.com and other but most of https not working!

[yipman]

As i see if i changed the proxy to local like 127.0.0.1 it's working fine but when i changing it to the public or all interface i see this problem!