File Upload add-on

[moaath odeh]

Hey,
I built a testLab for my bachelor thesis about FileUploads and wanted to test the owasp zap file upload add-on on it.

I am having troubles understanding how to make it work. From what i have seen, all i need to do is provide the url where the file will be uploaded (which i did). but somehow the add-on doesnt work (or maybe i am clueless since i am fairly new to owasp zap).

Can someone help me?

here are the steps that i made:
1.install add-on

2. configure add-on: in static url => http://localhost:10001/uploads/lvl1/$(fileName)

3. run automated test (aka active scan)

4. examine the results => nothing about file uploads

what i have also noticed is that the request sent to the website does not look like a multiform-data request:
owasp request body of post: fileToUpload=test_file.txt&submit=Upload

normal request (for example):

• --abcde12345
• Content-Disposition: form-data; name="fileName"; filename="file1.txt"
• Content-Type: text/plain
• 
  
• [file content goes there]

another question would be. how can i configure the scan to only test fileUpload? since its the only test i am interested in?

thx in advance!

[Simon Bennetts]

Hiya,

See this blog post: https://www.zaproxy.org/blog/2021-08-20-zap-fileupload-addon/

FYI this is a third party add-on and not maintained by the ZAP Core Team.

Cheers,

Simon