Pentesting Blazor Server Apps using Zaproxy

[Najam Ul Saqib]

Does ZAP support Blazor apps? Blazor communicates primarily through SignalR (web-sockets) in binary opCode, will ZAP be able to scan them? I see one addon i.e. BTP on burp but that is not very feature-rich. Pentesting blazor apps seems surprisingly challenging.

[thc...@gmail.com]

Hi,

The WebSockets add-on allows you to intercept (and decode, if you know
how, e.g. WebSocket Sender script) the binary messages.

You can also create new connections and fuzz them, there's not active
scan support of WebSockets yet though.

Best regards.

[Najam Ul Saqib]

Yes, but Blazor Server uses MessagePack binary format which is unreadable/non-editable; we can intercept the messages through web sockets but can't change them or see whats going on.

[thc...@gmail.com]

You can, decode/encode it to read/edit it:
https://github.com/msgpack/msgpack/blob/master/spec.md

(There are libraries available if you don't want to write an en/decoder
from scratch.)

Best regards.

[Najam Ul Saqib]

How can this be integrated with ZAP?

[thc...@gmail.com]

Depends on how you want to do it, either you create a little Java add-on
or through scripting (e.g. GraalVM JavaScript allows to import libraries).

Best regards.

[Najam Ul Saqib]

As per https://www.aon.com/cyber-solutions/aon_cyber_labs/new_burp_suite_extension_blazortrafficprocessor/

"While Blazor server uses MessagePack, the traffic is specifically formatted according to Blazor’s own Hub Protocol specification. Therefore, generic MessagePack parsers like the Burp Suite MessagePack extension available from the BApp Store will not work with Blazor traffic. Take the following BlazorPack message for example. If we use the MessagePack extension on this message, the result is just 25 and the rest of the message is ignored. This is because \x00 - \x7f represent positive integers in the MessagePack specification. The extension sees the first \x19, converts it to the decimal value of 25, and fails to parse the rest of the message. We’ll need a customized MessagePack parser to properly read these messages."

The msgpack library wont work with Blazor messages.

[thc...@gmail.com]

"We’ll need a customized MessagePack parser to properly read these
messages."

There you have it, customize the MessagePack parser.

Best regards.

On 08/03/2024 07:18, Najam Ul Saqib wrote:
> As per
> https://www.aon.com/cyber-solutions/aon_cyber_labs/new_burp_suite_extension_blazortrafficprocessor/
>
>
> "While Blazor server uses MessagePack, the traffic is specifically
> formatted according to Blazor’s own Hub Protocol specification. Therefore,
> generic MessagePack parsers like the Burp Suite MessagePack extension
> available from the BApp Store

> <https://portswigger.net/bappstore/c199ec3330864d548ff7d6bf761960ba> will

> not work with Blazor traffic. Take the following BlazorPack message for
> example. If we use the MessagePack extension on this message, the result is
> just 25 and the rest of the message is ignored. This is because \x00 - \x7f
> represent positive integers in the MessagePack specification

> <https://github.com/msgpack/msgpack/blob/master/spec.md#overview>. The