Mapping ZAP Plugins to issued http requests

[Sam Hakim]

Good Day,

In the Active Scan tab I can see which Plugins were used (SQL Injection, External Redirect, etc) and I can also see a list of http requests that were sent to the web-app.  What is the best way to identify/map which Plugins are responsible for which http requests?

Thanks

[Simon Bennetts]

Right now we dont really have this information available, unless the plugins raise associate issues (in which case their ID is in that issue) :(
One option would be to run the plugins one at a time, then you can be sure of where the requests come from (I realise this is not ideal).

I'd have no problem with an option to add a custom header, eg something like X-ZAP-SCAN-ID: 123
But it would have to be defaulted to off, otherwise WAFs would just block all requests containing that header by default and give a false sense of security to their users ;)
And it might well be a non trivial change :/
If that would be useful then please raise it as an enhancement request https://code.google.com/p/zaproxy/issues/entry :)

Cheers,

Simon

[Sam Hakim]

Thanks for the response.  I was looking into ways to visualize how ZAP attacks web-apps using something like logstalgia[1], but instead of ip-addresses on the left, we would see ZAP plugins.  This would allow one to see in action which plugins are responsible for which http requests.

[1] http://code.google.com/p/logstalgia/

[Simon Bennetts]

That looks neat.
And I've just thought of a way we could inject a header in a consistent way without huge changes :)

Raised as https://code.google.com/p/zaproxy/issues/detail?id=1573

Anyone interested in implementing it?

[Colm O'Flaherty]

What about msg.setNote? last time I checked, this existed, but I stopped using it in active scanners because there was no place to view it. This approach would have the advantage of not being sent to the web server or WAF, so there would be nothing extra to detect, and no requirement to turn it on our off.

[Simon Bennetts]

Notes are shown at a 'note' icon in the History 'Note' column, and accessed via the 'right click' "Note..." option ;)
These are really intended to be for user defined notes, so I'm not sure I'd really want them to be used via code as you might end up with every url having a note, swamping the users ones.
Another option would be tags, eg of the form ZAPID=123
I suspect this isnt something that many people would use, so I still think the optional header could be the best option.
But I'm happy to accept the majority view :)