PREVISION AUTHENTICATION TESTER DOCKER

[Nicollas Teixeira]

Hey guys! I've been trying to automate the login with zap for docker for some time but it seems complicated... the ideal for my case would be something similar to authentication tester in the GUI because it works perfectly... I need to automate login for authenticated pages for different urls and many sometimes I don't have access to all of them to be able to customize the settings and then the authentication tester comes in that would do all this configuration for me

[Nicollas Teixeira]

I would like to know if there is any forecast for the launch of something precise like the authentication tester for docker version

[psiinon]

Hiya,

So the Authentication Tester is designed to only work in the GUI, because its for manual checking.

OK, so you can run it using the ZAP GUI in Docker via WebSwing but I'm guessing you want to automate this.

However if it works then ZAP will be able to authenticate in docker / automation using the same underlying mechanisms as described on https://www.zaproxy.org/blog/2023-05-02-authentication-auto-detection/

Have a look at that and let us know if you have any questions.

Cheers,

Simon

--
You received this message because you are subscribed to the Google Groups "ZAP User Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to zaproxy-user...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/e3d44994-5c3d-438a-8eba-8356311bd165n%40googlegroups.com.

--

ZAP Project leader

[Nicollas Teixeira]

Oh thanks, it will probably work, just one more question, I configured the automation yaml file and when I run the automation it has the functionality I need, it manages to create the request for login, the problem is that it is putting %username% twice instead of putting %password% in the place of password, would I configure the order of this in the yaml file?

[psiinon]

From what I can see that is right.

The %username% and %password% strings are tokens - ZAP replaces these with the relevant values for the user you select.

You should not need to make any changes.

Cheers,

Simon

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/2cefdded-21fd-4fbd-aaaa-d676b1dad1d4n%40googlegroups.com.

--

ZAP Project leader

[Nicollas Teixeira]

Yeah, but look:

zap configured it this way
username={%username%}&password={%username%}

it should be
username={%username%}&password={%password%}

and it would work perfectly.  With the wrong replacement, its replacing password with the username value.

[psiinon]

Oh, yeah, right :)

Yes, you need to change that manually.

Cheers,

Simon

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/6dc552e4-40d8-4f58-a6e0-2d23abcd98dfn%40googlegroups.com.

--

ZAP Project leader

[Nicollas Teixeira]

Ohh okay, i thought it could recognize and replace username on the username field and password in the username password... i will customize the yaml and check what i can do lol, thanks again Simon

[psiinon]

Yes, it would be better if it did this :)

However as you are configuring that manually ZAP probably doesnt know at that stage which way around the username and passwords are.

It should work correctly with autodetection because you will have told ZAP the credentials.

Cheers,

Simon

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/4761926a-eeca-4348-a276-4ca2cd368bd4n%40googlegroups.com.

--

ZAP Project leader

[Nicollas Teixeira]

yes, it is all set up with autodetect but it is still getting confused when putting username and password, it is repeatedly putting the username

[psiinon]

OK, thats a bug.

Can you raise it as one?

https://github.com/zaproxy/zaproxy/issues

I'll aim to look at it asap..

Many thanks,

Simon

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/ba7fed3e-70fc-4a19-82bc-a929b72685f6n%40googlegroups.com.

--

ZAP Project leader

[Nicollas Teixeira]

Sure, i will open an issue, thanks for the fast answer Simon and thanks for helping me

[Nicollas Teixeira]

Done!

https://github.com/zaproxy/zaproxy/issues/8035

[psiinon]

Thanks!

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/23fd8963-03e7-45a4-8930-92565101429cn%40googlegroups.com.

--

ZAP Project leader

[Nicollas Teixeira]

Hey Simon, just saw you guys added a label add-on on my issue, i would like to know when it will probably be released, if you have this metrics

[thc...@gmail.com]

The add-ons can be released anytime, but the issue needs to be fixed
first. :) (The issue will be closed in that case.)


Note that the labels are indicative and they might change (e.g. if the
issue ends up being in core instead of an add-on).

Best regards.

>>>>>>>>>>>>> <https://www.zaproxy.org/docs/docker/webswing/>but I'm

>>>>>>>>>>>>>> <https://groups.google.com/d/msgid/zaproxy-users/e3d44994-5c3d-438a-8eba-8356311bd165n%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>>>>>>>>>>>> .
>>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>>
>>>>>>>>>>>>> --
>>>>>>>>>>>>> ZAP <https://www.zaproxy.org/> Project leader

>>>>>>>>>>>>>
>>>>>>>>>>>> --
>>>>>>>>>>>> You received this message because you are subscribed to the
>>>>>>>>>>>> Google Groups "ZAP User Group" group.
>>>>>>>>>>>> To unsubscribe from this group and stop receiving emails from
>>>>>>>>>>>> it, send an email to zaproxy-user...@googlegroups.com.
>>>>>>>>>>>>
>>>>>>>>>>> To view this discussion on the web visit
>>>>>>>>>>>> https://groups.google.com/d/msgid/zaproxy-users/2cefdded-21fd-4fbd-aaaa-d676b1dad1d4n%40googlegroups.com

>>>>>>>>>>>> <https://groups.google.com/d/msgid/zaproxy-users/2cefdded-21fd-4fbd-aaaa-d676b1dad1d4n%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>>>>>>>>>> .
>>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> --
>>>>>>>>>>> ZAP <https://www.zaproxy.org/> Project leader

>>>>>>>>>>>
>>>>>>>>>> --
>>>>>>>>>> You received this message because you are subscribed to the Google
>>>>>>>>>> Groups "ZAP User Group" group.
>>>>>>>>>> To unsubscribe from this group and stop receiving emails from it,
>>>>>>>>>> send an email to zaproxy-user...@googlegroups.com.
>>>>>>>>>>
>>>>>>>>> To view this discussion on the web visit

>>>>>>>>>> https://groups.google.com/d/msgid/zaproxy-users/6dc552e4-40d8-4f58-a6e0-2d23abcd98dfn%40googlegroups.com
>>>>>>>>>> <https://groups.google.com/d/msgid/zaproxy-users/6dc552e4-40d8-4f58-a6e0-2d23abcd98dfn%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>>>>>>>> .
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> --
>>>>>>>>> ZAP <https://www.zaproxy.org/> Project leader

>>>>>>>>>
>>>>>>>> --
>>>>>>>> You received this message because you are subscribed to the Google
>>>>>>>> Groups "ZAP User Group" group.
>>>>>>>> To unsubscribe from this group and stop receiving emails from it,
>>>>>>>> send an email to zaproxy-user...@googlegroups.com.
>>>>>>>>
>>>>>>> To view this discussion on the web visit

>>>>>>>> https://groups.google.com/d/msgid/zaproxy-users/4761926a-eeca-4348-a276-4ca2cd368bd4n%40googlegroups.com
>>>>>>>> <https://groups.google.com/d/msgid/zaproxy-users/4761926a-eeca-4348-a276-4ca2cd368bd4n%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>>>>>> .
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> ZAP <https://www.zaproxy.org/> Project leader

>>>>>>>
>>>>>> --
>>>>>> You received this message because you are subscribed to the Google
>>>>>> Groups "ZAP User Group" group.
>>>>>> To unsubscribe from this group and stop receiving emails from it, send
>>>>>> an email to zaproxy-user...@googlegroups.com.
>>>>>>
>>>>> To view this discussion on the web visit

>>>>>> https://groups.google.com/d/msgid/zaproxy-users/ba7fed3e-70fc-4a19-82bc-a929b72685f6n%40googlegroups.com
>>>>>> <https://groups.google.com/d/msgid/zaproxy-users/ba7fed3e-70fc-4a19-82bc-a929b72685f6n%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>>>> .
>>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> ZAP <https://www.zaproxy.org/> Project leader

>>>>>
>>>> --
>>> You received this message because you are subscribed to the Google Groups
>>> "ZAP User Group" group.
>>> To unsubscribe from this group and stop receiving emails from it, send an
>>> email to zaproxy-user...@googlegroups.com.
>>>
>> To view this discussion on the web visit

>>> https://groups.google.com/d/msgid/zaproxy-users/23fd8963-03e7-45a4-8930-92565101429cn%40googlegroups.com
>>> <https://groups.google.com/d/msgid/zaproxy-users/23fd8963-03e7-45a4-8930-92565101429cn%40googlegroups.com?utm_medium=email&utm_source=footer>
>>> .
>>>
>>
>>
>> --
>> ZAP <https://www.zaproxy.org/> Project leader
>>
>

[Nicollas Teixeira]

oh okay thc thanks, I hope this comes soon

[Nicollas Teixeira]

Hey Simon, I learned to use the automation framework better and managed to authenticate myself and do authenticated spidering, the problem is being the scan, it is being done empty, below is my script and print of the active scan

---

env:

  contexts:

  - name: "AUTOMATED"

    urls:

    - "http://x/WebGoat"

    includePaths:

    - "http://x/WebGoat.*"

    excludePaths: []

    authentication:

      method: "browser"

      parameters:

        loginPageUrl: "http://x/WebGoat/login"

        browserId: "firefox-headless"

        loginPageWait: 20

      verification:

        method: "autodetect"

    sessionManagement:

      method: "autodetect"

      parameters: {}

    technology:

      exclude: []

    users:

    - name: "auth"

      credentials:

        password: "password"

        username: "administrator"

  parameters:

    failOnError: true

    failOnWarning: false

    progressToStdout: true

  vars: {}

jobs:

- parameters:

    scanOnlyInScope: true

    enableTags: false

    disableAllRules: false

  rules: []

  name: "passiveScan-config"

  type: "passiveScan-config"

- parameters:

    context: "AUTOMATED"

    user: "auth"

    url: "http://x:8080/WebGoat"

    maxDuration: 0

    maxDepth: 0

    maxChildren: 0

    acceptCookies: true

    handleODataParametersVisited: false

    handleParameters: "IGNORE_COMPLETELY"

    maxParseSizeBytes: 0

    parseComments: false

    parseGit: false

    parseRobotsTxt: false

    parseSitemapXml: false

    parseSVNEntries: false

    postForm: true

    processForm: true

    requestWaitTime: 0

    sendRefererHeader: false

    userAgent: ""

  tests:

  - onFail: "INFO"

    statistic: "automation.spider.urls.added"

    site: ""

    operator: ">="

    value: 10

    name: "At least 10 URLs found"

    type: "stats"

  name: "spider"

  type: "spider"

- parameters:

    context: "AUTOMATED"

    user: "auth"

    url: "http://x:8080/WebGoat"

    maxDuration: 999999

    maxCrawlDepth: 999999

    numberOfBrowsers: 10

    maxCrawlStates: 0

    eventWait: 1000

    reloadWait: 1000

    clickDefaultElems: true

    clickElemsOnce: true

    randomInputs: true

    inScopeOnly: true

    runOnlyIfModern: false

    excludedElements: []

  tests:

  - onFail: "INFO"

    statistic: "spiderAjax.urls.added"

    site: ""

    operator: ">="

    value: 100

    name: "At least 100 URLs found"

    type: "stats"

  name: "spiderAjax"

  type: "spiderAjax"

- parameters:

    maxDuration: 0

  name: "passiveScan-wait"

  type: "passiveScan-wait"

- parameters:

    context: "AUTOMATED"

    user: "auth"

    policy: ""

    maxRuleDurationInMins: 0

    maxScanDurationInMins: 0

    addQueryParam: true

    delayInMs: 0

    handleAntiCSRFTokens: true

    injectPluginIdInHeader: true

    scanHeadersAllRequests: true

    threadPerHost: 8

  policyDefinition:

    defaultStrength: "insane"

    defaultThreshold: "high"

    rules: []

  name: "activeScan"

  type: "activeScan"

- parameters:

    template: "risk-confidence-html"

    reportDir: "C:\\x"

    reportTitle: "ZAP Scanning Report"

    reportDescription: ""

  name: "report"

  type: "report"

Its like a ghost scan, no requests lol, could you help me?

[Nicollas Teixeira]

The spider worked correctly, it found all the expected urls, the problem occurs in the active scan step

Em quinta-feira, 31 de agosto de 2023 às 13:01:52 UTC-3, psi...@gmail.com escreveu:

Thats weird :/

OK, lets take this one step at a time - home many URLs do the spiders find?

Does it look to be as many as you expect?

Cheers,

Simon

[kingthorin+zap]

I wonder if it has something to do with passing "" (empty string) as the policy?

[Nicollas Teixeira]

it didn't interfere... I've tried leaving it without that parameter and the result is the sameit didn't interfere... I've tried leaving it without that parameter and the result is the same

[Simon Bennetts]

Strange - I cant see anything obviously wrong.

Are there any errors in the zap.log file?

https://www.zaproxy.org/faq/somethings-not-working-what-should-i-do/#check-the-log-file

Cheers,

Simon