ZAP Java API - how to set HTTP request method and headers during Active Scan

409 views
Skip to first unread message

chuck

unread,
May 20, 2016, 6:08:55 AM5/20/16
to OWASP ZAP User Group
Having difficulties finding in API documentation or in this group, how to set/modify http requests details. Specifically would like to change requests to use POST method instead of GET and also provide "Authorization" header in requests. Can somebody assist on that ?
Launching ZAP proxy in daemon mode, to perform Active scan using the code:

ClientApi api = new ClientApi(ZAP_HOST, ZAP_PORT, true);
api
.accessUrl(url);
Ascan ascan = new Ascan(api);
ApiResponse resp = ascan.scan(null, url, "True", "False", null, null, null);

Thanks

Simon Bennetts

unread,
May 24, 2016, 7:48:03 AM5/24/16
to OWASP ZAP User Group
The current version of the API doesnt directly support proxying via ZAP for POST messages.
However you can just access your URLs using standard java libraries as long as you set ZAP as the proxy.
Its worth noting that as it stands your code will only attack the single URL that you've specified.
If you want to attack more than that then you will need to explore your app, either using more requests or by using the standard or Ajax spiders.

Cheers,

Simon

chuck

unread,
May 24, 2016, 7:57:09 AM5/24/16
to OWASP ZAP User Group
Thanks for reply, Simon.
Actually started to do that in the way you described, by performing requests with running ZAP as a proxy, saving the session, than run activeScan in terms of this session on recorded requests.
Is there any plan to extend it to support  "POST" in the future?
Thanks again

Cheers
Reply all
Reply to author
Forward
0 new messages