ZAP API Forced Browsing

[Gil Fernandes]

Hello,

I'm automating ZAP by writing a Python script using the ZAP API.

I wanted to include the Forced Browse method to perform brute force on the website using a directory list.

I tried using the methods zap.urlopen and zap.core.send_request. However, these methods have proven to be toooooo slow in comparison to the Forced Browsed feature used in the ZAP GUI.

Can I integrate the Forced Browse feature into my Python script using the ZAP API and if so how?

Is there a better method to automate the Forced Browse feature in ZAP?

Thank you all in advance.

[Simon Bennetts]

Hiya,

I'm afraid there is currently no API for Forced Browse.

An alternative is Fuzzing .. but there no API for that either :/

These APIs have not been a priority as we think they are less likely to be used in automation.

You can actually add your own APIs via an extender script: https://github.com/zaproxy/community-scripts/tree/main/extender

Or you could implement the API calls in ZAP ...

Cheers,

Simon