Proxying and scanning Vaadin based web application

[Andreas Falk]

I am currently trying automatic security scanning of an application implemented using Vaadin framework (which is based on GWT with mainly server side extensions).
I am following the wiki entry for regression testing with ZAP.

But during proxying the requests of the Vaadin application in ZAP only one URL entry is shown.
Is there a way to configure ZAP to detect the different pages of a vaadin application as different URL entries, so that these can be scanned afterwards?

Thanks.

[kingthorin+owaspzap]

What version of ZAP are you using?

[Andreas Falk]

I am using latest released version 2.3.1 of ZAP
I did not try weekly version as I have not seen any information hinting that anything has changed regarding gwt/vaadin support.

[Simon Bennetts]

Hi Andreas,

It sounds like Vaadin is whats known as a "single page application".
In other words instead of having urls like:

• https://www.example.com/page1
• https://www.example.com/page2
• https://www.example.com/page3

it has urls like:

• https://www.example.com/home&page=page1
• https://www.example.com/home&page=page2
• https://www.example.com/home&page=page3

is that correct?

By default ZAP build up its model of an application using the 'standard' url pattern, ie the structure is denoted by slashes.

So in the first case we have 3 pages (page1, page2 and page3) but in the second case we just have one (home) with 3 different parameter values.

However you can configure ZAP to understand that the 'page' parameter is part of the application structure by:

1. Adding your application to a context
2. Opening the Session Properties dialog and navigating to the 'Structure' panel for that context
3. Adding the relevant parameter(s) to the list of "Structural Parameters"

You should then see that the Sites tree changes from something like:

• https://www.example.com
• GET home(page)

To something more like:

• https://www.example.com
• home
• page
• GET page1
• GET page2
• GET page3
  

Can you try that and let us know if it works for you?

Cheers,

Simon